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in  the  course  of  the  study.  Constant  and  increasing  failure  rates  were 
included  to  address  erosion!  wear,  and  fatigue  failure,  as  well  as  random 
failures.  Principal  varlaj/les  in  these  expresrions  included  mission  duration, 
operating  time,  and  the  number  of  operating  cycles.  For  special  cases  (such 
as  engine  valves,  injectors,  thrust  chambers)  where  design  approaches  were 
varied,  the  designl>fe  goals  for  the  specific  application  were  included 
as  i nifipa'mten t-vafTab  1 es . 


Inherent  in  the  real  lability  modeling  was  a quantitative  assessment  of  the 
uncertainty  associated  with  each  estimate.  jThe  log  normal  distribution  was 
used  as  the  uncertainty  model  for  each  component.  The  parameters  character* 
izing  the  log  normal  distribution  fcjr-otfch  application  were  determined 
where  possible  from  the  scj£X*r~t5f  statistical  variance  of  reported  failure 
rates  foiijBach--compoTrenT. 


‘System  level  assessments  were  performed  using  functionally  oriented  fault 
trees.  The  functional  approach  was  used  to  yield  fault  trees  that  are 
least  affected  by  changes  and  revisions  at  the  component  level.  System 
assessments  were  performed  by  aggregating  the  component  reliability  and 
uncertainty  results  through  the  fault  tree  logic  using  computer  programs 
and  approximation  techniques  which  were  modified  or  developed  for  this 
purpose. 
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PREFACE 


This  final  report  presents  the  results  of  a study 
conducted  from  March  1975  through  February  1977.  The  pri- 
mary objective  of  the  study  was  to  develo,.  a sound  stand- 
ardized basis  for  reliability  comparisons  of  thermochemi- 
cal and  electric  propulsion  concepts  applicable  to  Air 
Force  satellite,  spacecraft,  and  upper-stage  mission  re- 
quirements. A corollary  objective  was  the  identification 
of  those  propulsion  system  components  which  currently  are 
the  major  contributors  to  propulsion  system  failures. 

This  study  was  performed  for  the  Air  Force  Rocket  Propul- 
sion Laboratory,  Edwards  Air  Force  Base,  under  contract 
number  F04611-75-C-0039  by  Booz,  Allen  Applied  -Research, 
a division  of  Booz,  Allen  & Hamilton  Inc. 

The  authors  are  indebted  to  the  following  organiza- 
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pecially for  their  review  and  critique  of  preliminary 
results : 
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Fairchild  Republic,  Farmingdale,  New  York 

Hamilton  Standard,  Windsor  Locks,  Connecticut 

Hughes  Research  Laboratory,  Malibu,  California 

Lewis  Research  Center,  Cleveland,  Ohio 

Lockheed  Missiles  and  Space  Corporation, 
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• SAMSO,  Los  Angeles,  California 

^ TRW  Systems,  Inc.,  Redondo  Beach,  California. 

The  cooperation  of  the  following  organizations  in  the 
technical  survey  is  also  gratefully  acknowledged:  Chemical 

Propulsion  Information  Agency,  Colorado  State  University, 
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Propulsion  Laboratory,  Lincoln  Laboratories,  The  Marquardt 
Company,  NASA  Goddard  Space  Flight  Center,  RCA  Astro  Elec- 
tronics, Rockwell  International,  Applied  Physics  Laboratory- 
Johns  Hopkins  University,  Princeton  University,  Walter 
Kidde,  United  Technologies  Corporation,  Tayco  Engineering, 
Aerojet  Nuclear,  Wright  Components,  Johnson  Space  Center, 
Celesco  Industries  and  Energy  Resources  Development  Ad- 
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TECHNICAL  APPROACH 


The  development  of  reliability  estimating  techniques 
was  focused  on  six  generic  propulsion  systems:  ion, 

pulsed  plasma,  colloid,  catalytic  monopropel] ant , electro- 
thermal monopropellant,  and  hypergolic  bipropeilant.  Pre- 
liminary review  of  these  systems,  their  expected  applica- 
tions, and  the  available  reliability  data  has  indicated 
that  the  successful  approach  required  the  following 
characteristics : 

• The  approach  had  to  be  synthesis  oriented.  It 
had  to  be  capable  of  combining  data  and  pro- 
cedures that  differed  in  origin,  character, 
and  degree  of  credibility. 

• The  approach  had  to  take  into  account  the  un- 
certainties associated  with  the  input  data  and 
estimation  procedures.  Furthermore,  these 
uncertainties  had  to  be  reflected  with  the 
estimates  that  resulted.  The  approach  had  to 
avoid  point  estimates  alone;  it  had  to  yield 
distributions  or  bounds  along  with  central 
measures. 

• The  approac’.  had  to  be  directed  toward  defining 
an  explicit,  step-by-step  methodology  and  was 
to  function  as  a usable  data  base  for  use  by 
designers  and  system  analysts  that  are  not 
necessarily  reliability  specialists. 

With  these  considerations  in  mind,  the  study  plan  as 
shown  in  Figure  1 was  developed  and  executed.  This  plan 
consisted  of  four  general  phases: 

• Data  Base  Definition 

• Electronic  Component  Reliability  and  Uncertainty 

Derivation 

0 Non  Electronic  Component  Reliability  and  Uncer- 

tainty Derivation 

0 Propulsion  System  Reliability  Estimation. 

These  phases  are  discussed  in  the  following  paragraphs. 
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Figure  1.  Reliability  Estimation  Procedures  Study  Plan 


DATA  BASE  DEFINITION 


Principally  this  phase  consisted  of  the  definition 
of  the  propulsion  system  components,  data  acquisition,  and 
data  representation.  The  six  generic  systems  identified 
earlier  were  expanded  to  seven  systems  in  order  to  assess 
two  approaches  to  ion  thrusters:  the  electron  bombardment 

mercury  ion  thruster  utilizing  a Kaufman  thrust  chamber 
and  the  electron  bombardment  cesium  ion  thruster  employing 
a magneto-electrostatic  containment  (MESC)  thrust  chamber. 
The  components  to  be  included  in  each  of  these  seven  sys- 
tems are  shown  schematically  with  typical  interfaces  in 
Figures  2 through  8.  These  figures  intentionally  exclude 
multiple  thruster  and  tankage  schemes  and  are  intended 
merely  to  identify  the  component  types  and  the  typical  in- 
terrelationships . 


Data  Acquisition.  Data  source  identification  and  the 
literature  search  were  begun  simultaneously  by  reviewing 
such  data  collections  as  AVCO,  FARADA  (GIDEP)  and  NEDCO  II 
and  by  the  initiation  of  searches  at  DDC  and  Chemical 
Propulsion  Information  Agency  (CPIA) . A summary  represen- 
tation of  literature  sources  and  the  applicability  of  the 
data  obtained  is  shown  in  Table  1.  Review  of  the  results 
of  the  literature  search  allowed  the  identification  of 
those  areas  pertinent  to  reliability  estimation  requiring 
further  attention.  An  interview  guide  addressing  those 
areas  was  formulated  for  use  in  the  technical  survey  which 
followed. 

The  data  acquisition  survey  included  23  GQvernment 
agencies,  industrial  firms  and  universities.  Over  50  in- 
dividual interviews  were  conducted  to  supplement  informa- 
tion available  from  the  literature  search.  Table  2 sum- 
marizes the  organizations  and  applicability  of  data  obtained 
from  the  survey. 


Data  Representation.  The  final  portion  of  the  data  defi- 
nition phase  involved  the  categorization  and  preliminary 
analysis  of  information  and  data  gathered  from  the  litera- 
ture search  and  technical  survey  activities.  This  analysis 
revealed  the  following  critical  characteristics  of  the  data 
base  that  was  available  for  the  development  of  reliability 
estimation  procedures: 

• Actual  data  was  limited  and  concentrated  in  two 
of  the  seven  systems 

• Actual  data  evidenced  wide  variability 
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Figure  2. 
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Figure  3.  Mercury  lor*  Electron  Bombardment 
Generic  System  Layout 
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Figure  5 
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Figure  6.  Catalytic  Monopropellant 
Generic  System  Layout 
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THRUSTER  CONFIGURATIONS 


Figure  7.  Electrothermal  Monopropellant 
Generic  System  Layout 
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Figure  8 


Hypergolic  Bipropellant  Generic  System  Layout 


Literature  Search  Summary 


Technical  Survey  Summary 


# Component  failure  mode  identification  was  pos- 
sible for  the  most  part,  but  in  a qualitative 
sense  only 

• All  reported  data  was  of  the  constant  failure 
rate  type,  and  with  few  exceptions  the  failure 
rate  v?s  based  on  mission  time  only 

4 Few  reliability  assessments  addressed  the  ques- 
tion of  prediction  bounds  or  uncertainty.  Models 
yielding  point  estimates  were  the  norm. 

It  was  expected  that  the  amount  of  data  would  be  limited. 
However,  its  concentration  in  the  catalytic  monopropellant 
and  Dipropellant  systems  posed  problems  for  the  components 
of  the  five  remaining  systems.  A significant  amount  of 
estimation  of  failure  rates  by  analogy  to  similar  component/ 
environment  situations  was  thereby  required.  Despite  the 
care  used  in  selecting  analogs  for  this  purpose,  this  pro- 
cess of  necessity  introduced  a significant  amount  of  uncer- 
tainty. Available  component  failure  rate  data  introduced 
its  own  contribution  to  uncertainty.  Estimates  of  failure 
rates  for  the  same  component  type  often  differed  by  several 
orders  of  magnitude.  The  importance  of  assessing  and 
tracking,  from  the  outset,  the  uncertainties  associated 
with  reliability  estimation  was  underscored  by  the  fore- 
going assessment.3  of  the  data  base. 

The  identification  of  component  failure  modes  was 
made  possible  by  the  descriptive  systems  and  component  in- 
formation acquired  through  the  literature  search  and  tech- 
nical survey.  With  the  exception  of  certain  valves, 
failure  rates  for  each  of  the  idc-ntified  component  failure 
modes  was  not  available  from  the  data  base.  For  this 
reason  the  principal  reliability  models  were  generated  at 
the  component  reliability  level.  Partitioning  to  the 
failure  mode  level  followed  the  development  of  system  fault 
trees.  The  results  of  that  effort  served  as  a guide  in 
determining  which  components  required  detailed  treatment. 

Most  sources  in  the  compiled  data  base  approached  re- 
liability estimation  as  the  determination  of  point  esti- 
mates using  constant  failure  rate  models  with  mission  time 
as  the  only  independent  variable.  The  complete  output  of 
any  predictive  process  is  a band  of  values  the  parameter 
in  question  is  likely  to  assume.  Point  estimates  such  as 
the  median  and  expected  value  are  simply  central  measures 
of  that  predicted  band.  The  size  of  that  band  is  deter- 
mined by  the  variance  in  scatter  of  the  input  data  and  the 
desired  level  of  confidence  in  the  expected  prediction. 
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ELECTRONIC  COMPONENT  RELIABILITY  AND  UNCERTAINTY 
DERIVATION 

Electronic  parts  or  components  differ  from  other  pro- 
pulsion system  components  in  a number  of  important  details 
that  influence  reliability  prediction  methodology.  Elec- 
tronic components  generally  are  subject  to  a relatively 
high  degree  of  standardization  and  respond  to  application 
stresses  and  requirements  in  quantitatively  predictable 
ways.  They  also  possess  a high  level  of  maturity  and  ex- 
hibit, with  some  important  exceptions,  life  distributions 
that  are  well -approximated  by  the  exponential  (constant- 
failure-rate)  distribution. 

These  characteristics  of  electronic  components  permit 
tabulations  of  failure  rates  and  adjustment  factors,  such 
as  those  contained  in  MIL-HDBK-217B U)  to  be  used  effec- 
tively. Considering  the  availability  of  reliability  es- 
timation data  at  the  parts  level  for  electronics  and  the 
principle  that  reliability  estimation  should  be  conducted, 
when  feasible,  at  the  level  corresponding  to  adequate  data, 
it  is  recommended  that  reliability  prediction  be  performed 
at  the  parts  level  for  electronic  assemblies,  such  as 
power  processors  and  switching  units. 


Failure  rate  variability.  With  rare  exceptions,  standard 
sources  of  failure  rate  data,  such  as  MIL-HDBK-217B , pro- 
vide only  point  estimates  of  failure  rates;  that  is,  a 
single  estimate  of  failure  rate  will  be  obtained  for  each 
fixed  combination  of  a specific  part  and  a defined  appli- 
cation. It  is  known,  however,  that  actual  failure  rates 
vary  significantly  not  only  from  vendor  to  vendor  but  also  - 
from  production  lot  to  production  lot,  under  nominally 
identical  conditions.  Usually,  it  is  impossible  not  only 
to  identify  the  specific  origin  of  parts  that  will  be  used 
in  a system  but  also  to  determine  the  specific  failure! 
rate  of  parts  having  a particular  origin.  As  a result, 
uncertainty  surrounds  the  failure  rate  estimates  that  arc 
used.  On  the  basis  of  experience,  however,  it  is' possible 
to  assign  a specific  form  and  estimate  the  parameters  of 
a distribution  characterizing  that  uncertainty.  Because 
the  failure  rate  estimates  obtained  from  MIL-HDBK-217B 
reflect  a mix  of  parts'  origins,  it  is  appropriate  to  treat 
such  estimates  as  defining  the  means  or.  expected  values 
of  the  corresponding  uncertainty  distributions. 
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By  examining  the  observed  failure  rates  or  rejection 
rates  in  screening  tests,  other  laboratory  tests,  or 
operational  experience  {e.g.,  as  reported  in  GIDEP/FARADA 
compilations) , it  is  possible  to  estimate  the  variance 
associated  with  the  uncertainty  distribution  for  specific 
parts.  Operational  experience  data  need  to  be  viewed 
with  caution,  however,  because  application  differences  are 
rarely  identified  sufficiently  to  permit  segregation  of 
their  effects  on  failure  rates.  Similar  caveats  apply  to 
screening  and  laboratory  data  unless  test  conditions  and 
failure  definitions  are  known  to  be  consistent.  For  all 
sources  except  screening  test  data,  many  part  types  pre- 
sent problems  in  that,  under  realistic  use  conditions, 
failure  rates  are  low  enough  so  that  many  observations  are 
"no  failures"  and  at  most  bounding-type  statements  can  be 
made.  However,  with  some  exceptions,  the  coefficient  of 
variation  is  sufficiently  consistent  over  a wide  variety 
of  electronic  parts  to  justify  a simpler  and  less  time- 
consuming  approach  to  uncertainty  estimation. 

An  early  examination  of  lot-to-lot  and  vendor-to- 
vendor  variability  in  failure  rates  indicated  that  such 
variability  could  be  represented  by  lognormal  distribu- 
tions with  the  square  of  the  coefficient  of  variation, 

t?2  = 2.74  (o\  «1.15  corresponding  to  a 100:1  ratio 

m 

between  the  larqest  and  smallest  failure  rates  observed 
in  a sample  of  40. f2)  That  analysis  was  based  largely  on 
screening  rejection  rates  for  late-1950's  transistors, 
diodes,  resistors,  and  capacitors.  A check  on  continuing 
validity  has  been  conducted  using  data  from  the  August 
1975,  revision  of  GIDEP,  volume  1,  Summaries  of  Failure 
Rate  Data (3).  a scan  of  this  document  led  to  identifica- 
tion of  Failure  rate  data  having  the  desired  properties 
for  two  electronic  part  types:  quartz  crystals  and  cir- 

cuit breakers.  The  desired  properties,  in  terms  of  mini- 
mizing extraneous  causes  of  variation,  were  reasonable 
sample  size,  multiple  entries  for  each  of  several  vendors, 
consistent  environmental  conditions,  and  single  reporting 
source.  Calculated  values  of  crin  were  0.995  and  0.937, 
respectively,  indicating  that  the  earlier  estimates  remain 
valid  (but  may  be  mildly  pessimistic) . Accordingly,  un- 
certainty about  (constant)  electronic  part  failure  rates, 
with  occasional  exceptions,  will  be  represented  by  log- 
normal distributions  with  expected  values  corresponding  to 
estimates  from  MIL-HDBK-217B , for  example,  and  variances 
based  on  o in  * 1.15.  (Examples  are  provided  in  Appendix  A 
of  this  section.)  The  following  relationships  may  be  use- 
ful in  evaluating  subsequent  calculations: 
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• Parameters  of  the  (normal)  distribution  of  the 
natural  logarithms  of  the  variate: 

ft : mean=median=mode 

a,  : standard  deviation 

In 

• Relationships  to  the  (lognormal)  distribution 
of  the  variate: 

Expected  value  e{X[  = exp  |m-  + -£• 

Coefficient  of  2 2 

variation  V = exp  (<r  ) -i 

Variance  vjx}  = E2  {A}1^ 

Analyses  and  graphic  displays  of  the  quartz  crystal 
and  circuit  breaker  data  are  presented  in  Tables  3 and  4 
and  Figures  9 and  10. 


Nonconstant  failure  rate  contributions.  A substantial 
body  of  literature  suggests  that  semiconductor  failure 
rates  tend  to  decrease  with  age,  rather  than  remaining 
constant.  Some  recent  analyses  of  in-orbit  experience  of 
NASA  spacecraft  appear  to  confirm  this  observation  and 
extend  it  to  some  other  types  of  electronic  parts. 

These  observations  are  consistent  with  the  first 
two  regimes  of  the  traditional  "bathtub"  curve  depic- 
tion of  failure  rate  behavior.  The  final  regime,  wear- 
out,  will  be  discussed  later.  In  the  absence  of  con- 
vincing evidence  or  theoretical  support  for  the  concept 
of  an  intrinsic  process  that  leads  to  monotonically  de- 
creasing failure  rates,  it  is  unwise  to  postulate  that 
such  decreases  will  prevail  beyond  the  period  of  ob- 
servation reflected  in  current  data.  It  is  suggested 
that  the  observed  decreases  should  be  disregarded  for 
extended-mission  reliability  prediction  purposes  for 
the  following  reasons: 

• The  observed  rate  of  decrease  becomes  too 
small  to  be  of  practical  significance  after  a 
relatively  short  period 

• The  decrease  can  be  viewed  as  reflecting  the 
behavior  of  a relatively  small  subpopulation 
consisting  of  the  "weakest"  parts,  and,  there- 
fore, should  not  be  expected  to  continue 


1-16 


TABLE  3.  CRYSTAL  FAILURE  RATESa 
(Ground-Life  Test) 

(Medium  Temperature  Stress,  Failures  per  106  Hours) 


CR 

-18A/U 

CR-56A/U 

CR 

-77A/U 

Kb 

3.845 

K 

12.409 

W 

49. 776 

H 

14.298 

E 

1.571 

M 

19.015 

W 

22.960 

Me 

4.  366 

M 

8.643 

B 

15.293 

E 

21.999 

H 

3.218 

H 

5.957 

H 

11. 357 

H 

12. 872 

K 

5.127 

K 

1.551 

W 

54.754 

B 

8.496 

H 

7.098 

H 

20.455 

W 

18.785 

Me 

1 . 4o5 

ur 
1 » 

41.513 

K 

6.639 

M 

57.  513 

11 

17.  898 

K 

3.  319 

K 

7.874 

M 

18.224 

H 

13.378 

K 

62.992 

M 

15. 621 

H 

16.054 

W 

59. 963 

13  6.086 

B 8.114 
M 5.712 
M 7.140 

Mean 

Logarithm  2.1457  2.0906  3.  0092 

Logarithmic 

Standard 

Deviation  . 5925  1.3459  . 8476 

TABLE  4.  CIRCUIT  BREAKER  FAILURE  RATES0 

(Ground) 

(Medium  Temperature  Stress) 

Failures  per  10®  Hours 

. 311 
3.  62 
2.  62 
1.89 
3.05 

1. 34 
.286 

2.35 
2.85 

. 3011 
. 9366 

^Source:  GIDFF  Vol.  1.  Rev.  August  1975. 

^The  letters  indicate  manufacturer  identification. 

Source:  GIDKP  Vol.  1,  Rev.  August  1975  (one- apparently 
redundant  entry  omitted). 


Mean  Logarithm 
Logarithmic  Stand- 
ard Deviation 
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• Effective  screening  of  electronic  parts,  which 
is  mandatory  for  extended-duration  missions, 
results  in  elimination  of  the  individual  parts 
whose  early  failure  otherwise  may  account  for 
the  observation  of  decreasing  failure  rates 

• Failure  rate  data  in  standard  sources  usually 
reflect  tests  or  operations  of  sufficiently 
long  duration  to  discount  the  decreasing 
failure  rate  effects  by  averaging. 

Conversely,  processes  that  may  lead  to  increasing 
failure  rates  must  be  considered  because  they  may  have 
substantial  influence  late  in  extended  missions.  Further- 
more, the  effects  of  these  processes  are  unlikely  to  be 
reflected  in  failure  rate  data.  From  shorter-term  obser- 
vations, candidate  failure  processes  of  this  kind  include: 

• Aging  of  organic  materials,  especially  insulation 
where  dielectric  properties  of  the  material, 
rather  than  physical  separation,  is  relied  upon; 
for  example,  in  coils  of  electromagnetic  devices 

• Contaminant  accumulation;  for  example,  in 
lubricants  or  on  electrical  contacts 

• Corrosion;  for  example,  electrolytic  corrosion 
of  electrical  connections  internal  to  resistors 

• Depletion  of  consumable  materials;  for  example, 
evaporation  of  lubricants,  sublimation  of  heater 
elements/filaments,  and  erosion  of  electrical 
contacts  or  electrodes 

• Diffusion;  for  example,  of  dopants  or  metalli- 
zation materials  in  semiconductor  devices,  or 
of  metals  through  insulators 

• Radiation  effects,  including  induced  changes  in 
bulk  or  surface  properties  of  semiconductor 
materials  and  chemical  changes  in  organic  ma- 
terials. 

Such  processes  tend  to  lead  to  relatively  sharply 
defined  lifetimes  for  the  affected  parts,  that  is,  to  uni- 
modal  life  distributions  with  small  (typically,  < 0.3) 
coefficients  of  variation.  However,  the  magnitude  of  the 
modal  life  is  likely  to  be  very  sensitive  to  interactions 
between  application  conditions  and  part  design  and  the 
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low  coefficient  of  variation  is  attainable  only  if  process 
controls  in  manufacturing  are  stringent.  Models,  such  as 
the  normal  distribution  or  the  Weibull  distribution  with 
large  shape  parameter  ( £ >3,  which  yields  results  very 
similar  to  the  normal  distribution) , are  often  used  jointly 
with  the  exponential  distribution  to  describe  the  onset  of 
aging  or  wear-out  effects.  The  problem  is  that  extended- 
mission  reliability  estimates  can  be  extremely  sensitive 
to  the  time  of  onset  of  the  effects  of  aging  phenomena. 

The  assumptions  needed  to  make  useful  reliability  estimates 
then  become  critically  important;  testing  to  assure  that 
the  onset  of  aging  effects  occurs  sufficiently  late  will 
usually  be  necessary.  Fortunately,  such  tests,  which  can 
usually  be  accelerated,  can  be  conducted  with  much  smaller 
sample  sizes  than  those  necessary  to  determine  constant 
failure  rates. 

(From  the  standpoint  of  minimizing  testing  burdens, 
it  also  is  worth  noting  that  wear-out  life  characterization 
for  components  of  complex,  nonrepairable  systems  need  not 
be  exhaustive.  Usually,  the  system  will  have  failed  by 
the  time  the  median  life  for  any  component  has  been  reached, 
thus  reducing  the  interest  in  statistical  details  of  com- 
ponent life  distribution  for  longer  periods.  However,  it 
may  be  important  to  know  whether  the  wear-out  failure  pro- 
cess competes  as  a cause  for  failure  for  all  members  of  a 
component  population  or  applies  only  to  a subpopulation 
having  special  characteristics,  such  as  the  presence  of  a 
contaminant  or  the  absence  of  an  inhibitor.  Truncation  of 
testing  can  lead  to  serious  estimation  errors  in  the  latter 
case. ) 

Of  the  candidate  failure  processes  identified  pre- 
viously, some  may  be  ruled  out  by  proper  precautions  in 
system  design.  Solid-state  diffusion  and  insulation  aging 
are  sharply  temperature-dependent  and,  for  10-year  or 
shorter  mission  durations,  can  be  virtually  eliminated  as 
significant  failure  processes  if  component  temperatures 
can  be  held  to  moderate  levels.  Radiation  effects  also 
can  be  minimized  if  the  radiation  environment  is  moderate 
and/or  shielding  is  possible.  For  some  components,  however, 
wear-out  processes  constitute  potentially  significant 
problems.  A more  specific  discussion  of  these  components 
appears  to  be  in  order. 


Components  subject  to  wear-out  processes.  There  are  at 
least  two  electronic  components  of  cenHTdate  propulsion 
systems  for  which  avoidance  of  significant  wear-out  ef- 
fects may  be  impracticable.  It  happens  that  both  components 
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are  peculiar  to  high-voltage  applications  and  are  found  in 
solid  propellant  pulsed  plasma  systems:  energy  storage 

capacitors  and  arc-initiation  {’’ignition'')  electrodes. 

Such  electrodes  also  may  be  found  in  other  plasma  systems 
and  may  be  subject  to  similar  phenomena  but  are  regarded 
as  special  cases  to  be  discussed  in  the  context  of  the 
systems  with  which  they  are  associated. 


Energy  storage  capacitors.  Energy  storage  capacitors  for 
pulsed  plasma  applications  are  required  to  provide  un- 
usually high  energy/weight  ratios  (energy  densities) . The 
capacitors  described  in  AFRPL-TR-74-50 (5)  appear  to  be 
reasonably  typical  at  40  J/lb  (2,500  volts,  50  microfarads). 
Energy  densities  as  high  as  125J/lb  (5,000  volts,  35  micro- 
farads) have  been  offered  commercially (6 ) but  with  life 
expectancies  on  the  order  of  3,000  discharges  at  full 
rated  voltage.  It  is  widely  accepted  that  life  expectancy 
for  capacitors  varies  inversely  with  the  fifth  power  of 
applied  voltage. 

High-energy  densities  are  obtainable  only  with  di- 
electrics that  are  thin  or  have  high  dielectric  constants; 
current  technology  requires  both.  This  limits  the  choice 
of  materials  and  generally  prevents  choosing  conservative 
derating  policies  (low  ratios  of  applied  voltage  to  rated 
voltage) . Some  high  dielectric-constant  materials  also 
have  relatively  low  maximum- temperature  limits  with  sharply 
decreasing  life  expectancy  above  50 °C,  making  conservatism 
impracticable  with  respect  to  operating  temperatures.  In 
addition,  some  otherwise  desirable  dielectrics  and  impreg- 
nants  are  quite  vulnerable  to  radiation.  Since  shielding 
of  these  capacitors  is  rather  difficult  because  of  their 
relatively  large  size  and  location  near  the  thrusters, 
missions  involving  substantial  radiation  doses  or  rates 
place  further  restrictions  on  choices  of  materials.  AFRPL- 
TR-74-50  (6)  describes  a construction  using  a sandwich  di- 
electric (one  layer  of  paper  between  two  layers  of  poly- 
vinylidene  flouride,  a high  dielectric-constant  material) 
and  castor  oil  impregnant.  The  capacitors  made  by  Maxwell 
Laboratories  for  Fairchild  Republic  Company  use  mylar  di- 
electric and  rr.onoisopropylbiphenol  (MIPB)  as  the  impreg- 
nant, the  latter  substituted  for  silicone  o- l for  reasons 
of  radiation  resistance  (?) . 

There  is  an  indication  that  Maxwell  Laboratories  lack 
failure  rate  and  life  data  for  capacitors  using  MIPB.  One 
of  the  authors  of  the  present  report  was  directly  involved 
in  a major  life  test  experiment  on  paper/mylar  capacitors 
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(MIL-C-14157)  using  related  impregnants . The  report 
on  that  life  test  is  generally  unavailable  but  a subsequent 
paper  provides  some  of  the  major  results  and  conclusions 
In  the  absence  of  more  recent,  definitive  data,  a 
qualitative  discussion  will  be  based  on  the  earlier 
results.  The  salient  results  of  the  test  were: 


• The  capacitor  life  test  observations  could  be 
described  reasonably  well  by  Weibull  distri- 
butions, but  with  both  shape  and  scale  para- 
meters differing  among  manufacturers  and  for 
differing  voltage  stresses. 

• In  most  cases,  equally  good  or  better  fits  to 
the  data  could  be  obtained  by  using  mixed  expo- 
nential distributions.  Suspected  heterogeneity 
within  capacitor  populations  makes  mixed  models 
more  appealing. 

• Results  for  capacitors  from  one  manufacturer 
are  important  because  certain  failures  clearly 
involved  impregnant  problems  and  constituted  a 
distinct  subpopulation  physically  and  statis- 
tically. The  most  satisfactory  model  consisted 
of  an  exponential  distribution  and  a normal  dis- 
tribution. 

As  noted  previously,  exponential/normal  mixed  models 
are  attractive  and  widely  used  for  electronic  devices 
subject  to  wear-out  phenomena.  In  the  case  of  the  par- 
ticular capacitor  life  test  cited,  9 percent  of  the  capa- 
citors of  one  manufacturer  failed  by  case  rupture  when 
tested  at  100  percent  of  rated  voltage  and  125°C  (the  tem- 
perature limit  for  mylar  if  phase  change  is  to  be  avoided) . 
The  remainder,  and  virtually  all  capacitors  from  other 
manufacturers,  failed  electrically. 

Considered  separately,  case-rupture  failures  could  be 
described  by  a normal  distribution  with  a mean  of  9,400 
hours  and  a standard  deviation  of  1,400  hours.*  Later 
diagnosis  of  the  case  ruptures  indicated  gas  evolution 
from  the  impregnant  as  the  cause.  A concurrent  "blind" 
analysis  of  impregnant  from  new  and  life-tested  capacitors 
by  infrared  spectroscopy  indicated  bond  breakage  and  in- 
dependently predicted  gas  evolution.  The  capacitor  manu- 
facturer stated  that  an  inhibitor  which  is  customarily 


See  Example  3 and  Figure  6 of  preceding  reference. 
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used  had  deliberately  been  reduced  or  omitted  in  manufac- 
ture of  the  capacitors  supplied  for  the  test. 

It  is  not  clear  whether  a distinct  subpopulation 
would  have  existed  in  the  absence  of  the  specific  actions 
reported  by  the  manufacturer.  It  is  also  impossible  to  be 
sure  that  similar  phenomena  would  not  have  been  encountered 
in  other  capacitors  at  a later  time  (the  life  test  was  ter- 
minated at  16,000  hours).  However,  the  results  indicate 
that  wear-out  phenomena  approximating  normal  distributions 
can  exist,  that  population  heterogeneity  is  a definite 
possibility,  and  that  life  limitations  due  to  impregnant 
characteristics  can  be  important  within  the  mission  dura- 
tions contemplated.  It  remains  to  be  considered  which 
stresses  are  likely  to  be  important,  whether  they  can  be 
reduced  sufficiently  to  delay  failure  beyond  mission  re- 
quirements, and  whether  it  is  possible  to  devise  tests 
that  can  provide  the  necessary  data  without  prohibitive 
costs  or  durations. 

The  problem  is  complicated  by  further  observations 
from  the  life  test.  Infant  mortality  is  in  evidence  for 
some  manufacturers  at  the  higher  voltage  stresses;  non- 
rupture wear-out  modes  also  appear.  Failure-rate  discon- 
tinuities indicate  that  distinct  failure  mechanisms  are 
operative,  although  no  physically  obvious  differences  were 
observed.  Perhaps  the  most  compelling  argument  favoring 
distinct  failure  mechanism  lies  in  the  differences  in  the 
effects  of  applied  voltage: 

• As  already  noted,  the  failure  rate  during  the 
period  of  essentially  "random"  failures  varied 
approximately  as  the  fifth  power  of  voltage 

• Infant  mortality  failure  rates  typically  varied 
approximately  as  the  seventh  to  ninth  power  of 
applied  voltage 

• Nonrupture  wear-out  failure  rates  varied  almost 
directly  with  applied  voltage 

• Applied  voltage  nad  little  or  no  effect  on 
failure  rates  for  rupture 

• For  all  types  of  wear-out  failure,  the  time 

of  onset  of  wear-out  was  virtually  independent 
of  applied  voltage. 
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Clearly,  increased  voltage  would  not  be  useful  as  a 
way  of  reducing  test  time  for  evaluation  of  wear-out  phe- 
nomena. (Applied  voltage  in  life  tests  ranged  from  about 
50  to  200  percent  of  rated  voltage) . 

It  remains  likely  that  temperature  constitutes  a use- 
ful accelerating  stress;  unfortunately,  the  life  test 
cited  was  restricted  to  125 °C,  a temperature  considerably 
in  excess  of  most  use  conditions.  The  impregnant  bond- 
breakage  phenomenon  held  responsible  for  ruptures  is  of 
the  kind  that  would  be  expected  to  follow  the  Eyring  (or 
Arrhenius)  equations,  with  the  rate  doubling  for  every  7° 
to  10  °C  increase  in  temperature.  For  the  rupture  pheno- 
menon, one  might  anticipate  an  increase  in  mean  life  from 
9,000  hours  at  125°C  to  the  vicinity  of  3,000,000  to 
40,000,000  hours  at  40°C.  It  would,  of  course,  be  unwise 
to  rely  on  such  an  extrapolation  without  exploratory 
testing  at  intermediate  temperatures,  although  the  model 
is  supported  by  a large  body  of  data  involving  insulation 
aging  in  electromagnetic  devices. 

The  potential  importance  of  radiation  effects  suggests 
their  exploration  through  life  tests  also.  Among  a variety 
of  possible  effects,  two  are  likely  to  be  synergistic  with 
heat  while  a third  may  be  mitigated  by  elevated  temperature: 

• Bond  breakage  and  bond  formation  (i.e.,  changes 
in  polymer  structure)  are  likely  to  be  induced 
by  radiation  with  rates  that  may  be  enhanced  by 
available  thermal  energy 


• Radiation  may  induce  ionization;  temperature 
will  determine  ion  mobility;  and  electrical 
fields  may  determine  the  resulting  damage,  in- 
cluding the  possibility  of  runaway  electrical 
breakdown 

• Decreases  in  electrical  conductivity  of  capa- 
citor foils  and  leads  may  be  reversible  by 
annealing  at  elevated  temperatures. 

Potential  interactions  such  as  these  make  it  necessary 
to  conduct  tests  with  stress  combinations.  Such  interac- 
tions also  may  interfere  with  attempts  to  use  accelerated 
testing.  Even  if  radiation  testing  can  be  performed  in 
isolation,  there  may  be  difficulties  due  to  confounding 
of  rate  and  dose  effects  under  accelerated  conditions. 


1-25 


Arc-initiation  electrodes.  Arc-initiation  electrodes  in 
# pulsed  plasma ' systems  are  provided  in  the  form  of  solid- 

state  plugs  that  somewhat  resemble  automotive  spark  plugs. 

In  an  internal  combustion  engine,  spark  plugs  are  intended 
to  furnish  the  energy  needed  to  initiate  combustion  and 
are  exposed  to  fuel-air  mixtures  and  exhaust  gases  above 
atmospheric  pressure.  In  a pulsed  plasma  system,  igniter 
plugs  generate  ionized  debris,  which  initiates  electrical 
breakdown  across  the  fuel  face.  The  igniter  plugs  are  ex- 
posed alternately  to  hard  vacuum  and  the  debris,  and  to 
remnants  of  a plasma  derived  from  tetrafiuoroethylene. 

The  two  devices  share  one  failure  mechanism,  electrode 
erosion,  but  otherwise  differ  sufficiently  to  make  relia- 
bility extrapolation  hazardous. 

It  appears  likely  that  the  reliability  of  arc-initia- 
tion electrodes  is  largely  determined  by  two  factors: 

• A low  and  possibly  constant  failure  rate  contri- 
bution due  to  manufacturing  flaws,  such  as 
cracks  in  insulator  bodies 

• A relatively  narrow  wear-out  type  distribution 
reflecting  electrode  and  surface  erosion. 

i This  conjecture  concerning  arc-initiation  electrodes 

' is  supported  by  laboratory  and  flight  experience  described 

by  the  Fairchild  Republic  Company  and  the  Applied  Physics 
Laboratory  of  the  Johns  Hopkins  University. 

Typical  applications  of  pulsed  plasma  systems  involve 
intermittent  use.  This  suggests  the  possibility  of  ac- 
celerated testing  by  increasing  duty  cycles  but  not  to  the 
point  where  effects  due  to  temperature  excursions  inherent 
in  normal  use  are  averted.  In  some  applications  (10) , 
dual  igniter  plugs  have  been  used  in  an  alternating  mode. 
Where  it  is  feasible  to  use  such  a configuration  to  obtain 
igniter  plug  redundancy,  the  time  intervals  for  demonstrating 
wear-out  free  performance  can  be  shortened  substantially. 


Summary.  Analyses  of  applications  of  electronic  components 
to  advanced  propulsion  systems  lead  to  the  following  key 
observations : 

• It  is  almost  always  possible  to  generate  some 

meaningful  reliability  predictions  for  electronic 
components  and  assemblies  from  available  data 
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• Inherent  variability,  not  just  application  un- 
certainties, makes  it  necessary  to  provide  quan- 
titative estimates  of  prediction  uncertainties. 

• The  validity  of  such  predictions  is  contingent 
upon  adequate  assurance  that  wear-out  phenomena 
will  not  become  dominant  within  anticipated  mis- 
sion durations.  Such  assurance  sometimes  will 
require  application-oriented  life  testing.  Ac-  . 
celerated  testing  techniques  often  may  be  applied 
with  care  for  this  purpose. 

In  general,  electronic  component  failure  rate  undertainties 
can  be  represented  adequately  by  lognormal  distributions 
whose  expected  value  is  determined  from  MIL-HDBK-217B,  and 
whose  coefficient  of  variation  is  a constant.'  Exceptions 
arise  when  the  degree  of  standardization  is’  low  and  when 
age-dependence  of  reliability  is  non-neaiigible.  Examples 
1,  2,  and  3 contained  in  Appendix  A illustrate  the  pro- 
cedures to  be  used. 


NON  ELECTRONIC  COMPONENT  RELIABILITY  AND  UNCERTAINTY 
DERIVATION 

As  in  the  case  of  electronic  devices,  observed  failure 
rates  for  nonelectronic  components  can  be  expected  to 
deviate  substantially  from  average  values  due  to  vendor- 
to-vendor  and  lot-to-lot  variations.  Additional  uncer- 
tainties surround  nonelectronic  components  for  several 
reasons: 


'4  Their  sensitivity  to  application-specific  efforts 

• Probable  existence  of  poorly  characterized  aging 
effects 

• A generally  lower  degree  of  component  standardi- 
zation. 

In  the  presence  of  aging  or  life-limiting  effects  of 
significant  magnitude,  it  is  impossible  to  characterize 
component  failure  rates,  reliability  estimates,  or  life 
expectancies  by  single-parameter  distribution.  At  a 
minimum,  two-parameter  distributions,  such  as  the  normal, 
gamma,  or  Weibull  (without  delay),  must  be  employed;  often, 
a mixture  of  distributions  representing  different  failure 
processes  is  appropriate.  These  conditions  increase  both 
model  complexity  and  the  difficulties  of  parameter  esti- 
mation. 
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Earlier  studies.  To  put  these  modeling  and  estimation 
problems  into  perspective,  Table  5 displays  some  results 
derived  from  earlier  studies  of  aircraft  flight  control 
components ( 11 > 12).  These  results  apply  to  single- 
parameter (exponential)  reliability  models  and  do  not 
directly  address  time-dependent  effects;  nevertheless, 
they  provide  some  indication  of  the  magnitude  of  uncer- 
tainties. 

For  each  device  listed  in  Table  5,  a lognormal  dis- 
tribution was  fitted  to  failure  rate  data  (principally 
from  FARADA) . The  coefficient  of  variation  and  the  lower 
(5  percent)  and  upper  (95  Percent)  Bayesian  confidence 
bounds  were  obtained  from  the  fitted  distribution.  The 
adequacy  of  fit  of  the  lognormal  model  was  checked  for 
device  types  providing  sufficient  data;  device  types 
providing  fewer  than  five  data  points  have  been  omitted 
from  the  table. 

For  the  devices  marked  by  c,  sufficient  data  points 
had  been  available  to  permit  some  investigation  of  signi- 
ficant time-related  failure  rate  trends  out  to  at  lease 
2,500  operating  hours.  No  trends  significant  from  both 
statistical  and  engineering  viewpoints  were  found.  (Un- 
fortunately, the  absence  of  such  trends  in  2,500  operating 
hours  of  operation  in  aircraft  environments  will  not 
usually  justify  dismissing  the  possibility  of  important 
time-related  effects  in  long-duration  space  missions.) 

It  is  interesting  to  note  that  the  coefficient  of 
variation  tends  to  be  lowest  for  components  that  are 
highly  standardized,  produced  by  a small  number  of  manu- 
facturers, or  comparatively  insensitive  to  application 
peculiarities.  (The  coefficient  of  variation  used  in  this 
report  for  electronic  components  is  1.66.)  However,  values 
at  the  low  end  of  the  range  may  be  illusory  in  view  of  a 
possible  unrecognized  duplication  of  specific  device  de- 
signs or  applications  an  a relatively  small  data  base. 

This  does  not  preclude  use  of  the  data  as  a guide  to  rela- 
tive variability  as  a function  of  device  type. 


Some  additional  considerations.  The  usual  objective  of 
component-level  reliability  prediction  is  to  allow  the 
estimation  of  system  reliability  for  various  mission  dura- 
tions or  specific  time  intervals  within  a mission.  Aside 
from  modeling  of  relationships  within  the  system,  this 
requires  component- level  estimates  for  corresponding  time 
intervals . 
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TABLE  5 . FAILURE  RATE  UNCERTAINTIES51 


b 

Device  type 

Coefficient 

of 

variation 

Failure  rate 
(per  million  hours) 

Lower  bound  Mean  Upper  bound 

Bolt 

0.5 

3.  7 

9.  1 

17.7 

Regulator,  tension 

0.  6 

14.4 

41.  8 

89 

Indicator,  airspeed0 
bomber  and  transport 

0.  74 

84.3 

310 

739 

fighter 

1.37 

225 

2081 

6660 

Servomechanism,  hydraulic 

0.  78 

25.9 

102 

251 

Bearing,  ball,  low  speed 

i.  0 

2.  8 

15.5 

43.  1 

Accumulator,  hydraulic0 

1.25 

28.  34 

224 

689 

Gyro,  rate 

1.3 

43.6 

367 

1150 

Actuator,  electric 

1. 49 

49.  1 

520 

1715 

Bearing,  journal 

1.6 

1. 74 

21.0 

71 

Cable,  mechanical 

1.  7 

1.  :,i 

20.3 

70 

Motor,  torque 

1.  8 

2.  85 

42.4 

149 

Spring 

2.  1 

2.43 

47.  9 

175 

c 

Cylinder,  hydraulic 

2, 14 

10.  2 

208 

761 

Bellcrank 

2.  4 

2.64 

66.6 

249 

Accelerometer 

2.7 

15.9 

500 

1890 

Solenoid 

2.  8 

4.  03 

136 

519 

Sheave 

2.  8 

0.23 

7.6 

29.0 

Filter,  oil 

3.0 

4.  28 

164.  2 

630 

Lamp 

3 ? 

2.0 

86.5 

333 

Tube,  tcique 

3.2 

0.53 

22.  8 

88 

c 

Actuator,  hydraulic 

3.  52 

10.  82 

559 

2160 

Switch,  pushbutton 

5.3 

1.6 

173 

657 

g 

For  selected  components,  aircraft  environment;  fitted  lognormal 
distributions;  data  from  AFFDL-TH-67-20  (Table  5 and  Appendix  B) 
and  AFFDL-TR-67-183  (Appendix  11), 

^Listed  in  ascending  order  of  coefficient  of  variation. 

CSufficient  data  to  indicate  absence  of  aging  effects  on  failure  rate 
to  2,  500  hour1'. 
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The  most  limited  useful  component-level  estimate  for 
characterizing  uncertainty  consists  of  a statement  of  two 
values  for  a single  specific  interval;  for  example,  the 
expected  value  and  a lower  confidence  bound  on  the  relia- 
bility of  a component  for  an  interval  beginning  at  0 and 
ending  at  some  time,  To.  In  the  absence  of  any  additional 
information,  the  only  further  statements  that  can  be  made 
from  such  estimates  are  that  the  corresponding  reliability 
estimates  must  be  at  least  as  high  for  any  elapsed  time 
ending  sooner,  and  no  higher  for  any  elapsed  time  ending 
later.  More  formally,  denoting  the  expected  value  of  re- 
liability for  an  interval  beginning  at  0 and  ending  at  t 
is  denoted  by  R(t)  and  the  corresponding  lower  bound  by 
R.  05  . 


R(t)  >R(T  ) 
~ o 


R.05(t,2R 


(T  ) 
05'  "o 


0 < t < T 


R(t)<  R{T  ) 
— o 


R.05(t) 


< R 


(T  ) 
05uo; 


T < t < °° 
o 


Of  course,  the  usual  definition  of  reliability  re- 
quires that  both  R (t)  and  R.05^  converge  to  1 as  t 
shrinks  to  0,  and  to  0 as  t increases  without  limit.  How- 
ever, the  rate  of  convergence  is  not  specified,  and  the 
limiting  values  are  not  useful  in  themselves. 


At  the  other  extreme,  if  one  accepts  as  "known"  that 
the  applicable  reliability  model  is  the  exponential  dis- 
tribution, R(T0)  and  R.Q5(T0)  are  sufficient  to  determine 
the  estimates  of  R(t)  and  R,o5(t)  for  all  values  of  t. 
This  occurs  because  the  expected  value  and  upper  confi- 
dence bo  ind  on  the  failure  rate  have  one-to-one  relation- 
ships with  the  T0  reliability  estimates.  This  condition 
does  not  hold  for  distributions  specified  by  two  or  more 
parameters.  For  example,  there  is  an  unlimited  number 
of  n , a pairs  yielding  any  specified  value  of  R(To)  for 
the  normal  distribution  but  with  differing  values  of  R(t) 
for  t f To. 


A variety  of  intermediate  situations  can  be  postulated, 
each  implying  certain  kinds  and  amounts  of  information  or 
a willingness  to  place  restrictions  on  the  form  of  the 
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reliability  model.  For  example,  one  may  be  willing  to 
stipulate  that  a Weibull  distribution  with  known  and  fixed 
shape  parameter  applies  because  this  model  and  parameter 
value  are  "known"  to  apply  to  the  class  of  components  un- 
der consideration.  Another  fairly  common  type  of  inter- 
mediate situation  is  one  in  which  a great  deal  is  considered 
"known"  to  apply  to  the  class  of  components  under  consid- 
eration. Another  fairly  common  type  of  intermediate 
situation  is  one  in  which  a great  deal  is  considered 
"known"  for  t JTQ  and  very  little  is  "known"  for  t>  T0. 

This  would  be  the  case  when  the  failure  process (es)  to  T0 
can  be  determined  from  observation;  however,  a subsequent 
wear-out  phenomenon  due  to  other  processes  is  anticipated. 


Procedures.  Since  the  ultimate  use  of  component-level  re- 
1 lability  prediction  will  be  in  the  derivation  of  system 
reliability  estimates,  it  is  desirable  to  anticipate  the 
requirements  of  the  latter.  The  system  reliability  models 
that  will  be  used  are  based  on  combinatorial  calculations, 
propagation  of  variance,  and  beta  distribution  models  for 
reliability  uncertainties  at  component  and  higher  assembly 
levels.  This  implies  a requirement  for  estimation  of  com- 
ponent reliability  expectations  and  uncertainties  for  any 
selected  time  within  the  intended  mission  duration. 

For  system  reliability  estimation  purposes,  the  beta 
distribution  model  for  each  component  at  each  selected 
time  must  be  defined.  It  is  possible  to  fit  a beta  dis- 
tribution to  any  two  fractiles,  central  measures,  or  mo- 
ments (e.g.,  mean  and  variance)  of  a reliability  uncer- 
tainty distribution  derived  from  other  sources.  In  general, 
it  is  not  possible  to  obtain  a beta  distribution  that 
exactly  matches  another  distribution,  such  as  one  derived 
from  a lognormal  uncertainty  distribution  of  failure  rates 
over  the  range  of  possible  values.  However,  a very  good 
match  over  the  range  of  maximum  interest  — from  the  fifth 
percentile  to  the  expected  value  — can  be  obtained  by 
making  the  distributions  congruent  at  the  fifth  percentile 
and  at  the  median.  Further  discussion  of  the  beta  dis- 
tribution is  provided  in  Appendix  B. 

If  the  form  of  the  component  life  distribution  is 
"known"  and  has  a single  uncertain  parameter  (e.g.,  the 
constant  failure  rate  in  the  exponential  distribution  or 
the  scale  parameter  of  the  Weibull  distribution) , that  life 
distribution  can  be  evaluated  at  any  selected  time,  t,  and 
for  any  desired  points  in  the  uncertainty  distribution. 

For  example,  assume  that  the  exponential  distribution 
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describes  component  life  and  that  the  failure  rate  (per 
million  hours)  is  described  by  a lognormal  uncertainty 
distribution  with  mean  natural  logarithm  2.28  and  logarith- 
mic standard  deviation  1.2.  Then  the  median  and  95th  per- 
centile failure  rates  (rounded  to  one  decimal  place)  are: 


X = e2*28  = 9.  8 per  106  hours 
. 5 


X = e2* 28+1,97  = 70.4  per  106  hours. 
• 9 5 


Since  fractiles  hold  in  transformation,  we  may  evaluate 
the  median  and  5th  percentile  of  the  reliability  uncer- 
tainty distribution  directly  for  any  value  of  t.  For 
t = 2,000  hours,  the  results  are: 


-2,  000  x 9.  8 x 10 
e 


0.  981 


R 


. 05 


-2,000  x 70.4  x 10 
e 


0.  869. 


Consider  the  alternative  that  the  observations  on  which 
reliability  estimates  are  to  be  based  involved  a 5,000- 
hour  exposure  of  the  components  and  led  to  the  conclusion 
that: 


R ,(5,  000)  = 0.  5 
• t) 

R n_  (5,  000)  = 0.  25. 
. U 0 


How  can  these  conclusions  be  translated  to  uncertainty 
distributions  for  time  intervals  other  than  5,000  hours? 

In  general,  estimation  procedures  will  need  to  be  dif- 
ferent for  intervals  ending  earlier  than  the  5,000-hour 
observation  time  and  for  those  ending  later. 

One  possibility  involves  a willingness  to  attribute 
a particular  life-distribution  form  with  fixed  parameters 
to  the  median  (k.os)  only.  Estimation  of  the  median  of 
the  uncertainty  distribution  then  involves  merely  the  sub- 
stitution of  the  desired  values  of  t.  The  alternative  is 
to  draw  a smooth  curve  connecting  the  starting  point  (0,1) 
with  the  observed  point  (5,000,  0.5),  choosing  a curve 
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shape  that  is  consistent  with  the  evaluation  of  failure 
processes  involved  (e.g.,  with  an  increasing  failure  rate) . 
In  either  case,  it  is  extremely  important  to  bear  in  mind 
that: 

• The  component  under  consideration  usually  will 
be  only  one  of  many  components  in  a system 

• Time  intervals  for  which  the  system  reliability 
is  low  are  not  of  interest  if  the  system  is 
nonrepairable 

• Reliability  of  the  component  will  need  to  be 
quite  high  if  the  system  reliability  is  not  so 
low  as  to  be  uninteresting,  unless  the  component 
is  used  in  a highly  redundant  configuration 

• The  important  component  reliability  estimation 
region  (the  important  part  of  the  life  distri- 
bution) , therefore,  usually  will  be  one  in  which 
the  predicted  reliability  is  well  in  excess 

of  0.9. 

These  observations  have  two  major  implications.  One 
is  that  R.5  = 0.5  is  a poor  choice  for  a starting  point; 
a value  on  the  order  of  R.5  = 0.9  would  be  much  more 
suitable.  (In  practice,  it  also  is  much  more  likely  to  be 
available  for  the  long-lived  components  of  interest.)  The 
other  implication  is  that  essentially  we  are  dealing  with 
tail  behavior  of  life  distributions,  which  reduces  both 
the  dependability  of,  and  the  sensitivity  to,  distributional 
forms  and  parameters.  Dependability  is  reduced  because 
extreme  tail  behavior  usually  is  determined  by  outliers 
rather  than  by  the  main  population;  if  not,  tail  behavior 
is  often  very  sensitive  to  distribution  parameters.  Sen- 
sitivity is  reduced  by  convergence.  This  point  may  be 
illustrated  by  examining  a fairly  wide  variety  of  distri- 
butions in  an  example  shown  in  Table  6,  all  having  the 
value  R(40,000)  = 0.9  in  common: 


TABLE  6 . EXAMPLE:  DISTRIBUTION  WITH  COMMON  R(40,  000) 


Condition  for 

Form  R(40, 000)  = 0. 9 Parameters 

— fi 

Exponential  . 105361 /X  = 40,000  X = 2.634  x 10 

Weilbull  (.  105361a  )!/^  40,  000  0 = 0.  5,  a = 1,  898 
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Table  6 (continued) 


Weilbuil 

(.  105361a)1  ^ = 40,000 

/}  = 2 , a = 1.5186  x 1010 

Weilbull 

(.  losseia)1^  = 40,000 

19 

3 = 4 , a = 2.4297  x 10 

Normal 

,U  - 1.  28a  = 40,  000 

H = 60,  000,  a = 15,  625 

Normal 

\X  - 1.  28(7  = 40,  000 

u = 80,000,  a = 31,250 

Normal 

H - 1.  28a  = 40,000 

H = 100,000, a = 46,  875 

For 

this  example  shown  in  Table 

6,  the  reliability 

values  at  four  lower  ages  and  one  greater  age  are  tabulated: 
TABLE  6 . EXAMPLE:  DISTRIBUTION  WITH  COMMON  R(40,  000) 


(Continued) 

Distribution  R(5000)  R(IO.OOO)  R(20,  000)  (R30.000)  R(80.000) 


Exponential 
2. 634  x 10‘6 

0. 9869 

0. 9740 

0. 9487 

0.  9240 

0. 8100 

Weioull 
0.5,  1808 

0.9634 

0.  94 °7 

0.9282 

0. 9128 

0. 8616 

2.  1.5186  x 1010 

0. 9984 

0.9934 

0. 9740 

0. 9425 

0.6561 

4,  2.  4297  x 10l9 

0.99997 

0. 9996 

0.9934 

0. 9672 

0. 1853 

Normal 

6C.000,  15,  625 
80,000,  31,  250 
100,000,  46,875 

0.  9998 
0.  9918 
0.9786 

0. 9993 
0.9875 
0. 9726 

0.9948 
0.  972 G 
0.  9561 

0.9726 
0. 9452 
0.  9323 

0.  1000 
0.5000 
0.6652 

The  differences 

displayed 

in  Table 

6 are  far 

from 

trivial.  Selecting  the  most  appropriate  distributional 
models  therefore  is  important.  For  ages  less  than  the 
common  point,  however,  relatively  little  added  obser- 
vational information  is  needed  for  adequate  parameter 
estimation  if  the  appropriate  distributional  form  has 
been  selected. 

If  the  additional  information  is  substantial,  even 
the  choice  of  distributional  form  may  not  be  too  critical. 
If,  for  example,  we  know  that  R(10,000)  * 0.99  as  well  as 
R(40, 000)  = 0.9,  the  parameters  of  a Weibull  distribution 
model  are  fixed  at  3 = 1.695,  a - 5.996  x 108,  and  for  a 
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normal  distrubution  model  p = 76,570,  or  = 28,570.  The 
single-parameter  exponential  distribution  cannot  be  fitted 
to  the  two  known  points.  If  we  are  willing  to  consider  the 
two-parameter  version  (exponential  distribution  with  delay 
or  guarantee  time),  we  find  A = 3.177  x 10“6,  a = 6,840. 
These  models  yield  the  values  presented  in  Table  7. 

TABLE  7 . TWO-POINT  FITTED  DISTRIBUTIONS 


Distribution 

F(5000) 

R<10,  000) 

R(20,  000) 

R(30,  000) 

R(80,  000) 

Exponential  w/delay 
3.  177  x 10“6,  6,  840 

1.0000 

0.  9900 

0. 9591 

0.9291 

0.7926 

Weilbull 

1.695,  5.996  x 10B 

0.9969 

0. 9900 

0. 9680 

0.  9374 

0.7110 

Normal 

76,570,  28,570 

0. 9939 

0. 9900 

0. 9762 

0. 9485 

0.4522 

The  results  displayed  in  Table  7 serve  to  illustrate 
an  important  and  obvious,  but  often  neglected,  point:  Any 
reasonable  distributional  model  fitted  to  observed  data 
can  provide  a good  description  within  the  range  of  obser- 
vations (in  the  example,  for  ages  up  to  40,000  hours),  but 
extrapolation  beyond  the  range  of  observation  is  strongly 
dependent  on  the  model  chosen.  Furthermore,  the  existence 
of  a good  observational  fit  does  not  guarantee  model  valid- 
ity. Thus,  it  is  concluded  that  extrapolation  is  risky 
even  when  no  new  failure  processes  need  to  be  anticipated 
at  greater  component  ages,  and  that  the  choice  of  the  life 
distribution  model  usually  needs  to  be  supported  by  infor- 
mation beyond  that  available  from  fitting  of  curves  to 
observational  data.  In  general,  that  information  comes 
from  insight  into  manufacturing  process  variations  and 
failure  processes  or  from  knowledge  about  the  long-term 
behavior  of  related  devices. 

Selection  of  a suitable  life  distribution  model  for 
R.5(t)  must  be  accompanied  by  the  choice  of  a corresponding 
model  for  R.05(t)  or  for  some  other  measure  of  reliability 
estimation  uncertainty,  unless,  as  discussed  previously, 
there  is  sufficient  faith  in  distributional  form  and  para- 
meters (e.g.,  exponential  with  A. 95)  to  permit  direct 
evaluation.  One  difficulty  that  should  be  noted  immediately 
arises  from  the  fact  that  life  distributions  from  the  same 
family  generally  cross  unless  some  restrictive  conditions 
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are  met.  Two  Weibull  distributions  with  parameters  «i, 
#i;  a2 1 will  cross  at 


1 


unless  01  - ft2,  while  two  normal  distributions  will  cross 
at  two  values  of  t unless  Ml  = M 2,  when  R(^l)  = R(  ^2)  “ 
0.5.  Unless  the  crossings  occur  outside  the  time  period 
of  interest,  Ro.5(t)  > R.ij(t)  for  some  range  of  t.  In  ad- 
dition to  this  illogical* inversion,  there  will  be  under- 
statement of  uncertainty  as  the  crossing  point  is  approached. 
Modifications  of  models  may  be  necessary  if  R.05(t)  i-3  to 
be  handled  in  life-distribution  form. 

Alternatively,  one  may  address  the  uncertainty  dis- 
tribution or  the  relationship  between  R.05(t)  and  R.5(t) 
directly.  This  approach  also  presents  some  problems.  As 
an  example,  consider  the  observation  R. 5 (5000)  * 0.9032, 

R. 05  (5000)  * 0.7499.  Attributing  the  exponential  distri- 
bution to  R.5(t)  yields  R, 5 (2005)  = 0.96.  Suppose  we 
choose  to  model  the  uncertainty  about  R(t)  by  a beta  dis- 
tribution.* The  beta  distribution  having  R.5  = 0.9032 
and  R.  05  **  0.7499  has  the  parameters  « = 15,  0*1.+  From 
a Bayesian  viewpoint,  the  sum  o'-  + ft  can  be  interpreted  as 
an  "equivalent"  sample  size;'  that  is,  it  would  charac- 
terize all  possible  posterior  distributions  derivable  from 
go-no  go  testing  of  a sample  of  size  a + ft  and  the  uniform 
beta  prior  distribution  with  «0  + ftQ  = 0.  On  the  grounds 
that  any  "test"  yielding  ]5  successes  and  1 failure  as  of 
5,000  hours  would  have  been  ibservable  in  principle  at  any 
earlier  time  with  sample  size  16,  one  may  argue  in  the  ab- 
sence of  any  other  information  that  ot  + ft  = 16  should  apply 
to  the  uncertainty  distribution  used  to  describe  information 
at  any  lesser  age.  It  happens  that  R.5  = 0.96  is  the 
median  of  the  beta  distribution  with  a = 16,  0=0,  and 
for  that  distribution,  R.05  = 0.8384. 


A detailed  discussion  of  this  convenient  model  is  pre- 
sented in  Appendix  B. 


X 

'There  are  two  common  notations  for  the  beta  distribution; 
the  notation  used  here  corresponds  to  _ T(  +0+2)  „x0 

f(R)  = r(Q+  nr<0+n  R (1"R)  * 
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In  order  to  determine  if  the  value  of  R<05(2005)  is 
consistent  with  the  available  information  and/or  intuition, 
one  possibility  is  to  seek  to  define  a reasonable  life 
distribution  that  yields  R. 05(2005)  = 0.8384,  R. 05 (5000)  = 
0.74S9.  These  values  are  satisfied  by  a Weibuli  distribu- 
tion with  /3  = 0.5766,  & = 335.81  (not  to  be  confused  with 
the  similarly  labeled  parameters  of  the  beta  distribution) . 
This  is  an  increasing  failure-rate  distribution,  implying 
that  the  uncertainty  attached  to  the  2,005-hour  reliability 
estimates  is  larger  than  would  be  the  case  if  we  were 
willing  to  attribute  the  exponential  distribution  to  R,o5 
as  well  as  to  R,5.  That  approach  would  yield  55  (2005)  = 
0.981.  In  many  cases,  the  implied  increase  in  uncertainty 
for  interpolation  would  be  acceptable  as  being  in  accord 
with  intuition  and  available  information,  but  the  judgment 
should  be  made  on  a case-by-case  basis  after  examining  the 
implications.  For  example,  the  model  would  be  inappropriate 
if  additional,  contradictory  evidence  were  available  from 
a separate  2,500-hour  test. 

(It  should  be  evident  that  the  process  of  reliability 
and  uncertainty  estimation  involves  ad  hoc  procedures  and 
subjective  judgment.  This  approach  is  not  at  all  incon- 
sistent with  the  Bayesian  approach  but  probably  is  unac- 
ceptable to  the  statistician  with  a "classical"  inclina- 
tion. Unfortunately,  he  is  powerless  to  deal  with  the 
problem  in  any  practical  way.) 

There  remains  the  problem  of  extrapolation  to  com- 
ponent ages  beyond  the  observed  data  coverage.  Statistical 
theory  provides  no  information  other  than  the  absolute 
requirements  that  any  reliability  function  be  monotonically 
nonincreasing  and  tend  to  0 as  age  approach°s  infinity. 
General  experience  adds  to  this  that  reliability  functions 
are  smooth  (i.e.,  continuous).  It  is  necessary  to  look 
elsewhere  for  useful  reliability  estimates. 

The  act  of  choosing  life  distribution  models  within 
the  span  of  observable  data  and  information  implies  some 
belief  that  the  models  relate  to  the  physical  processes 
that  lead  to  device  failure.  The  degree  of  belief  will 
vary  and  will  be  reflected  in  the  uncertainty  models 
chosen.  It  follows  that  the  first  step  in  extrapolation 
involves  two  questions: 

• Is  it  reasonable  to  expect  the  same  physical 
processes  to  continue? 
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• How  rapidly  does  uncertainty  about  the  validity 
of  the  life  distribution  model  or  its  parameters 
increase? 

The  first  question  is  related  primarily  to  the  life 
distribution  model;  the  second,  to  the  uncertainty  dis- 
tribution model.  {Continuity  and  monotonicity  are  not  re- 
quirements for  the  latter;  it  is  quite  reasonable  to 
specify  increasing  uncertainty  as  one  moves  away  from  a 
"known"  point  in  either  direction.) 

The  answer  to  the  first  question  almost  always  will 
be  affirmative.  However,  a further  question  must  be  asked: 
Are  there  additional  failure  processes  (or  changes  in  im- 
pact of  the  same  failure  processes)  that  may  becom.r-:  signi- 
ficant during  the  time  interval  to  be  considered  in  the 
extrapolation?  For  example,  frictional  wear  may  be  the 
predominant  failure  process  reflected  in  the  life  distri- 
bution model.  At  greater  component  ages,  wear  may  con- 
tinue, but  fatigue  may  become  the  primary  failure  process. 

Thus,  extrapolation  must  rely  entirely  on  knowledge, 
analysis,  and  judgment,  in  the  domain  of  engineering  and 
the  physical  sciences;  statistical  methods  serve  only  to 
describe  the  results  with  one  exception.  The  purpose  of 
reliability  prediction  and  estimation  of  uncertainties  is 
to  aid  in  decisionmaking,  and  Bayesian  statistical  methods 
are  closely  related  to  decision  theory,  especially  to  the 
notion  of  loss  functions.  The  choice  of  models  may  be  in- 
fluenced by  the  consequences  to  be  expected  from  decisions 
that  formally  rely  on  the  models.  Most  importantly,  the 
models  should  be  used  to  decide  how  to  allocate  limited 
test  resources  among  tests  of  the  components  of  a proposed 
system  to  maximize  information  gain  (uncertainty  reduction) , 
a topic  addressed  in  the  description  of  computer  program 
BETAL1  in  the  Computer  Program  Section  of  this  report. 


Component  Reliability  Derivation.  Analysis  of  the  data 
base  revealed  an  exclusive  use  of  single  parameter  con- 
stant failure  rate  component  reliability  expressions. 
Furthermore,  the  single  parameter  was  almost  always  mis- 
sion time.  While  this  uniformity  of  approach  was  very 
attractive,  especially  when  aggregation  to  the  systems 
level  was  intended,  it  was  not  the  most  descriptive  of 
the  components,  their  duty  cycles,  or  their  operating  en- 
vironments . 
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The  approach  employed  in  developing  this  methodology 
was  the  individual  assessment  of  each  component  and  letting 
that  assessment  determine  the  type  of  failure  rate  to  be 
employed  and  the  parameter  or  parameters  to  be  used  in  the 
model.  As  can  be  expected,  with  the  broad  range  of  compo- 
nents, the  result  of  this  approach  was  a diverse  collection 
of  models.  However,  it  decided  to  proceed  along  these 
lines,  developing  the  more  complex  aggregating  techniques 
requiring  rather  than  artificially  constraining  the  com- 
ponent level  models  in  the  interest  of  methodology  simpli- 
city. 


The  derivation  process  can  be  characterized  by  the 
following  steps: 


• Component  assessment  in  the  context  of  its 
system  application 

• Structuring  the  component  reliability  model 

• Model  quantification 

• Model  verification 

• Failure  mode  modeling. 


Component  Assessment.  Rather  than  impose  generalization 
across  systems , each  component  was  assessed  within  the 
context  of  its  system  application.  While  this  required 
multiple  assessments  of  similar  components,  it  yielded 
generalized  component  models  based  on  demonstrated  simi- 
larities rather  than  a priori  assumptions.  These  assess- 
ments identified  the  principal  failure  modes,  mechanisms, 
and  the  parameters  to  which  component  reliability  seemed 
sensitive. 


Structuring  the  Component  Reliability  Model.  The  results 
of  the  foregoing  assessment  were  converted  next  into  dis- 
crete expressions.  Some  failure  mechanisms  (such  as  manu- 
facturing flaws)  implied  random  failure  situations  which 
were  best  modeled  by  constant  failure  rate  models.  Others 
(such  as  erosion,  wear,  or  compaction)  implied  increasing 
failure  rate  situations.  The  Weibull  model  was  used  to 
model  these  situations.  Several  components  exhibited 
mechanisms  of  both  types.  These  were  modeled  using  a com- 
posite expression  containing  constant  failure  rate  and 
increasing  failure  rate  contributions. 
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While  failure  rates  and  types  are  of  obvious  impor- 
tance, a second  equally  important  consideration  is  the 
variable  upon  which  they  are  dependent.  These,  too,  were 
identified  in  the  assessment  process  and  were  included  in 
the  modeling  process.  Typically,  these  parameters  were 
number  of  cycles,  operating  time,  and  mission  time.  Exam- 
ples of  the  resulting  models  are  shown  below. 


Constant  Failure  Rate,  Simple 


(Fill  Valve) 


R=exp(-At) 


Where  t=elapsed  mission 
time 


Constant  Failure  Rate,  Compound 


(Relief  Valve) 


R=exp  [-Xmt-xcN] 


where  t=elapsed  mission 
time 

N=Number  of  cycles 


Increasing  Failure  Rate,  Simple 


Electric  Isolator) 


R=exp 


a 


where  t=elapsed  mission 
time 

«=Weibull  scale 
parameter 
/3=Weibull  shape 
parameter 


Increasing  Failure  Rate,  Compound 

2 T 


(Catalyst  Bed  - Steady  State) 


R=exp 


-N 

a 


2 

ns 


3 t' 

- n - ss 


a 


a 


Composite  Model 


R=exp  -At, 


-) 


m 


J2B1’5 

a 


where  N=number  of  steady 
state  firings 
n=number  of  cold  starts 
t =steady  state  oper- 
ating time 

(Filter) 

where  t^-elapsed  mission 


hours 


'op=operating  hours 
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Uncertainty  distribution  modeling  presented  a situation 
requiring  a different  approach.  Component  failure  rate 
data  was  too  sparse  to  directly  identify  the  type  of  dis- 
tribution that  would  best  characterize  failure  rate's 
variabilxty.  Rather  than  rely  simply  on  judgment,  previous 
experience  suggested  a simplifying  alternative.  It  has 
been  found,  almost  universally  that  the  uncertainty  distri- 
bution of  a generic  failure  rate  is  skewed  to  the  right. 
Values  much  larger  than  the  expected  value  are  more  likely 
to  occur  than  values  correspondingly  smaller.  This  is  also 
in  accord  with  intuition;  a failure  rate  much  worse  than 
the  generic  mean  seem,  more  likely  to  be  observed  chan  one 
.'that  is  much  better  Good  fits  to  the  log  normal  distri- 
bution, which  corr  • ^onds  to  this  behavior,  have  been 
found  to  be  common.  This  distribution  was  assessed  against 
all  available  failure  rate  data  on  a componenc  by  component 
basis.  It  was  found  that  this  distribution  could  be  used 
in  the  uncertainty  distribution  to  characterize  the  reported 
variability  in  all  but  a few  component  failure  rates.  The 
exceptions  were  best  modeled  using  a normal  distribution. 


Model  Quantification.  Assigning  values  to  the  model  para- 
meters "was  the  next- step  in  the  development  process. 
Available  data  provided  overall  component  failure  rates. 

With  the  exception  of  valves  there  was  virtually  no  parti- 
tioning of  failure  rates  to  failure  modes.  A second 
problem  was  the  exclusive  use  of  constant  failure  rate 
models  for  all  components  in  previous  reliability  assess- 
ment efforts.  Moreover,  virtually  all  used  mission  time- 
related  failure  rates;  only  a few  developed  cycle-or 
pulse-dependent  failure  rates.  Finally,  for  some  of  the 
more  novel  propulsive  systems,  virtually  no  failure  rate 
data  was  available  on  a large  number  of  components.  For 
these  items,  the  failure  rates  employed  were  derived  from 
analogous  component/environment  situations  for  which  data 
was  available.  In  addition,  significant  extrapolation 
was  required  to  bridge  the  gap  between  the  documented 
endurance  tests  and  the  long  mission  durations  ( > 5 yrs) 
of  interest.  In  short,  the  process  of  model  quantification 
was  far  from  a rigorous  statistical  exercise.  Extensive 
use  of  engineering  judgments  was  required  to  yield  usable 
component  reliability  models.  As  can  be  expected,  the 
uncertainty  involved  in  these  judgments  is  relatively  high. 
This  situation  further  underscored  the  need  for  tracking 
the  uncertainties  associated  with  the  reliability  estimating 
procedures.  As  the  experience  base  grows  with  additional 
test  and  in  service  use  and  more  explicit  failure  rates  are 
identified,  this  uncertainty  can  be  expected  to  decrease. 
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Two  procedures  used  in  the  model  quantification  pro- 
cess are  worth  highlighting.  The  first  involved  the  adap- 
tation of  reported  constant  failure  rate  data  for  use  in 
models  involving  Weibull  expressions.  Two  judgments  were 
required  by  the  process : first,  an  estimate  of  the  point 

when  the  failure  rate  would  begin  to  increase,  and  second, 
an  assessment  of  the  Weibull  shape  factor.  The  shape 
factor  strongly  influences  the  severity  of  the  slope  of  the 
increasing  failure  rate.  With  these  two  estimates,  the 
constant  failure  rate  model  and  the  increasing  failure 
rate  (Weibull)  model  could  be  equated  and  the  Weibull 
scale  factor  could  be  determined.  That  is,  the  reliability 
model  usinq  constant  failure  rate  is  expressed  as: 

i^exp.f-Axl  where  A = constant  failure  rate 


x = parameter  upon  which 
reliability  is  dependent 

(such  as  operating  time, 
flight  time  cycles,  etc.) 


and  the  increasing  failure  rate  (Weibull)  model  is  given  as: 


R=exp 


where  x = parameter  upon  which 
reliability  is  dependent 


0 = Weibull  shape  factor 


a = Weibull  scale  factor 

At  that  value  of  x where  the  failure  rate  \ begins  to 
change,  both  models  will  yield  the  same  estimate  of  relia- 
bility. If  this  value  and  the  value  of  0 (characteris- 
tically between  1 and  3)  are  estimated,  the  Weibull  scale 
parameter  can  be  found  directly: 

This  approach  was  used  in  conjunction  with  the  pro- 
cedure used  to  transition  from  constant  to  increasing 
failure  rate  models.  For  components  evidencing  a strong 
design  sensitivity  to  expected  mission  life,  the  transition 
point  to  increasing  failure  rate  was  defined  as  a percent  of 
the  design  life  rather  than  a fixed  number  of  hours  or 
cycles . 
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where  x°  = the  value  of  x where 

is  expected  to  change 

0°=  the  estimated  value  of 
the  shape  factor 


taking  the  logarithms. 


Ax 


The  second  procedure  involved  the  introduction  of 
component  design  life  into  the  reliability  model.  The 
design  of  some  components  is  relatively  insensitive  to 
operating  life.  Whether  the  planned  use  calls  for  one 
thousand  or  one  million  operating  hours  or  cycles,  the 
component  design  is  virtually  the  same.  Other  compo- 
nents, typically  those  prone  to  corrosion,  erosion, 
wear,  fatigue,  etc.,  have  their  design  strongly  tailored 
to  the  expected  mission  life.  For  these  components  it 
would  not  be  appropriate  to  extrapolate  conditions  in 
evidence  at  the  end  of  one  year's  use.  This  wonld  be 
simply  unrealistic.  If  a 5-year  mission  were  anticipated, 
then  a component  designed  for  this  expected  life  would 
have  been  used.  Where  comparison  of  two  components  (such 
as  the  1-  and  5-year  designs)  was  desired,  comparisons 
were  based  upon  service  life  as  a percent  of  design  life, 
for  example,  suppose  an  estimate  of  conditions  is  desired 
after  4 years  on  a component  designed  for  5-year  life. 

The  data  base  available  for  assessment  is  drawn  from  a 
similar  component  designed  for  1-year  life.  Rather  than 
simply  extrapolating  from  the  available  data,  examination 
of  conditions  at  the  four-fifths  or  80  percent  design 
life  of  the  1-year  component  should  be  made.  The  results 
of  this  assessment  form  a more  realistic  estimate  of  what 
might  be  expected  after  4 years  of  the  operation  of  a 
component  designed  for  5 years  life.  This  approach  was 
used  in  conjunction  with  the  procedure  used  to  transition 
f.om  constant  to  increasing  failure  rate  models.  For  com- 
ponents evidencing  a strong  design  sensitivity  to  expected 
mission  life,  the  transition  point  to  increasing  failure 
rate  was  defined  as  a percent  of  the  design  life  rather 
than  a fixed  number  of  hours  or  cycles. 
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Two  types  of  partitioning  readily  identified  them- 
selves in  this  modeling  process.  The  first  was  one  where 
the  failure  modes  and  portions  of  the  component  model 
aligned  themselves  on  a one-to-one  basis.  The  second  re- 
quired subdivision  of  component  model  elements  in  order 
to  generate  the  failure  mode  model.  These  situations  are 
best  described  by  the  following  examples. 

Example  1.  One-to-One  Correspondence 
Component:  Filter 
Model:  R = exp  j-At  -top3  j 
Fail  Modes:  Leaking,  Clogging 
Partitioning: 

Leaking  Mode  R = exp(-At) 

Clogging  Mode  R = exp 


Example  2.  Component  Model  Subdivision 
Component:  Isolation  Valve  (Normally  Closed) 

Model:  R=exp  j-AcN  - \ mt| 

Failure  Modes:  Fail  Open,  Fail  Closed,  Fail  Partial,  Leak 
to  space 

Failure  Mode  Frequency:  Based  on  data  base  and  judgment 
Mode Frequency  Factor  by  Failure  Rate 


Open 

10% 

*x 

K0=.l 

A 

K0c=.i 

Closed 

30% 

Kc=.  3 

Kc  = .3 

Partial 

55% 

Kp  = . 55 

CO 

tl 

a 

& 

Leak  to  Space 

5% 

K^.05 

o 

II 
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The  final  step  in  the  component  reliability  modeling 
process  was  the  quantification  of  the  uncertainty  distri- 
bution. As  mentioned  earlier  the  log  normal  distribution 
would  be  used  throughout.  The  variability  in  reported 
failure  rates  evidenced  by  each  component  was  used  to 
tailor  the  log  normal  distribution  to  reflect  the  uncer- 
tainty associated  with  that  particular  component's  relia- 
bility expression.  The  log  normal  distributions  were 
characterized  by  specifying  the  coefficient  of  variation 
and  the  mean.  Wherever  possible  these  parameters  were 
determined  directly  from  the  reported  failure  rates  for 
the  component.  Where  no  failure  rates  or  a few  divergent 
estimates  were  available,  judgment  once  again  had  to  be 
relied  upon  to  yield  credible  and  realistic  results. 


Model  Verification.  Upon  completion  of  the  component  re- 
li ability  model  development,  a request  for  comments  was 
initiated.  The  models,  supporting  rationale,  and  other 
descriptive  material  were  submitted  to  26  selected  Govern- 
ment and  industry  organizations  representing  a cross  sec- 
tion of  auxiliary  propulsion  system  designers,  developers, 
manufacturers,  prime  contractors  and  user  agencies. 

The  responses,  received  from  more  than  half  of  the 
addressees,  were  very  useful  in  refining  the  methodology. 
There  was  general  agreement  with  the  approaches  taken  and 
the  results  achieved.  Where  differences  existed  alter- 
natives were  always  suggested.  Almost  all  suggestions 
were  incorporated  in  the  refinement  process.  Since  ana- 
logous component/environment  combinations  were  often  used 
in  developing  component  models,  it  was  found  that  alter- 
native analogs  were  especially  useful.  A second  major 
outcome  of  this  process  was  the  completion  of  the  model 
generalization  process.  Component  models  were  initially 
generated  by  assessing  each  component  within  the  context 
of  its  system  application.  While  generalizations  were 
suspected,  it  was  considered  preferable  to  have  these 
generalizations  result  from  demonstrated  similarities  in 
the  models  and  from  concurrence  .in  the  review  process. 

As  a result  of  this  review  it  was  possible  to  replace  the 
seven  systems  categories  of  components  with  two:  electric 
propulsion  systems  components  and  thermochemical  propul- 
sion systems  components. 


Component  Model  Partitioning.  The  component  level  analysis 
yielded  nearly  sixty  reliability  models.  Because  of  the 
limitations  of  the  available  data,  subdivision  of  these 
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models  to  the  failure  mode  level  was  conducted  on  a 
selective  basis.  Indiscriminate  (and,  for  lack  of  defini- 
tive data,  often  arbitrary)  partitioning  to  the  failure 
mode  level  would  have  introduced  undesirable  increases  in 
system  level  uncertainty  without  increasing  understanding 
of  component  or  system  reliability  behavior. 


Approach  to  Component  Model  Partitioning.  Fault 
tree  requirements  were  used  as  the  partitioning  criteria. 
Components  often  appeared  in  several  places  in  a system 
fault  tree  each  time  reflecting  a different  failure  mode. 

For  example,  under  a fault  tree  portion  entitled  "Propel- 
lant Flow  Too  Low"  a number  of  valves  appeared  as  failing 
closed  or  partially  open.  In  another  portion  of  the  same 
tree  "Propellant  Flow  Too  High",  the  same  valves  appeared 
as  failing  open  or  leaking  to  space.  Neither  situation 
required  the  entire  failure  model  but  rather  some  subdivision. 
In  these  cases  partitioning  to  component  failure  modes  was 
conducted. 


Partitioning  Techniques.  Review  of  the  available 
component  models  produced  two  readily  identifiable  par- 
titioning techniques,  direct  and  K-factor. 

The  direct  methot  was  us. ,>d  in  those  cases  where  a 
one  to  one  relationship  existed  between  a failure  mode 
and  a portion  of  the  component  model.  For  example,  the 
developed  filter  model  was: 

t0 

R = exp  [-  X t - ] 

where  X - constant  failure  rate  dependent 
on  mission  time 
increasing  (Weibull)  failure 
rate  parameters  dependent  on 
operating  time,  t 

The  identified  failure  modes  were  clogging  and  excessive 
flow  (due  to  leakage  or  fracture) . The  clogging  mode 
failure  rate  was  assessed  as  increasing  with  increasing 
filtration  (that  is  with  increasing  operating  time)  and  the 
leakage  mode  failure  rate  as  being  constant  throughout  the 
mission.  This  resulted  in  a direct  partitioning  of  the 
model.  The  model  for  the  clogging  mode  became: 
t 

R * exp  [ 

and  the  model  for  leaking  became 
R = exp (-  \ t) 
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Other  component  types  {principally  valves)  had  failure 
modes  that  reflected  part  of  each  of  the  model  constituents. 
Partitioning  factors  (k  factors)  had  to  be  developed  in  these 
cases  to  subdivide  the  model.  For  example  the  latch  valve 
model  was  formulated  as 

R = exp  [-  \CN  - \ft] 

where  ,\c  = failure  mode  per  cycle 
N = number  of  cycles 

= failure  mode  per  mission  hour 
t = mission  hours  elapsed 

The  identified  failure  modes  for  this  valve  were  fail  open, 
fail  closed,  fail  partial,  and  leak  to  space.  A simple 
breakdown  was  not  possible  in  this  case.  Both  number  of 
cycles  and  elapsed  mission  time  influenced  the  failure 
modes  and  had  to  be  so  reflected.  The  result  was  the 
following  matrix 


Mode 

K-factor 

x c 

Xf 

Fail  Open 

kd 

.1 

.1 

Fail  Closed 

KC 

.3 

.3 

Fail  Partial 

Kp 

.55 

.6 

Leak  to  Space 

kl 

.05 

.0 

The  values  of  the  K factors  were  developed  from  what 
ever  partitioning  information  was  available  (principally 
from  the  GIDEP  source)  and  judgment  in  application  to  the 
component/environment  situation.  They  were  then  applied  to 
the  expected  value  of  the  failure  rate,  E{^}  . [The  expected 
value  e{*}  was  the  parameter  obtained  from  analysis  of  the 
data  base.]  The  procedure  was  as  follows.  For  the 
Fail  Open  mode: 


E Uco)  =K0E{AC} 

where  E {^co)1*  expected  value  of  the 
cyclic  failure  rate  in 
in  the  fail  open  mode. 

Ko  ~ K factor  determined  for 
, . the  fail  open  mode. 

E \^q)  = expected  value  of  the 
component  model  cyclic 
failure  rate. 
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The  variance  of  the  failure  rate  (a  basis  for  uncertainty 
about  the  component  results)  must  also  be  carried  to  the 
failure  mode  level: 

v jxcoj  = K0V  jxc| 

where  V jxcoj  = the  var-!-ance  of 

expected  value  of  the 
cyclic  failure  rate  in 
= the  open  mode 

V Ac!  = is  the  variance  of  the 
component  model  cyclic 
failure  rate. 

The  following  development  of  uncertainty  parameters 
will  deal  with  the  cyclic  failure  rate  in  the  open  mode, 
only  so  the  subscript  "CO”  will  be  dropped  for  clarity. 

The  coefficient  of  variation,  rj  , for  the  log  normal 
distribution  characterizing  the  failure  mode  is  given  by 


A 

i 

\ 

\ 

E 

1 

A 

j 

where  V j ^coi  and  E were  defined  above. 

The  standard  deviation,  a for  the  required  lognormal  dis- 
tribution can  be  obtained  from 

2 = exp  [ a 2 ] - 1 

<r  = \flnir\2  + 1) 

The  mean  of  the  distribution,  n , is  given  by 


or 

2 

t I Qc 

H = In  [E  j A j ] - y~ 

The  median  and  the  bounds  on  the  cyclic  failure  rate  in  the 
open  mode  follow: 

. Median 

A 5 = exp ( M ) 
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. 5%  Lower  Bound  (L.B.) 

X Q2  = exp[  (X  - 1.64485  ct- ] 

. 95%  Upper  Bound  (U.B.) 

X g5  = exp[  y.  + 1.64485  a ] 

This  process  was  then  repeated  for  the  cyclic  failure 
rate  in  the  closed  mode,  partial  mode  and  leak  mode  and  for 
the  flight  time  failure  rate  in  applicable  modes  to  complete 
the  characterization  at  the  failure  mode  level. 


SYSTEMS  RELIABILITY  ESTIMATION 

At  this  point  in  the  development  of  the  methodology, 
reliability  (and  uncertainty)  models  for  all  the  required 
components  had  been  formulated  and  quantified.  What  was 
required  at  the  system  level  was  a framework  to: 

. Describe  the  systems  and  identify  the  appropriate 
component  models  required  by  each. 

. Provide  the  system  specific  logic  network  to  aiJ'w 
for  proper  model  aggregation. 

Alternative  Approaches.  The  most  common  approaches  to  the 
analysis  and  description  of  component/system  relationships 
are  failure  modes,  effects  and  criticality  analysis  ( FMECA) 
and  fault  tree  analysis  (FTA) . FMECA  displays  are  in 
tabular  form,  and  are  usually  accompanied  by  reliability 
block  diagrams  to  aid  understanding  and  to  facilitate  con- 
struction of  mathematical  reliability  models.  FTA  analyses 
and  displays  are  in  logic-diagram  form,  so  that  the  equiva- 
lent of  a reliability  block  diagram  is  inherent. 

FTA  can  be  characterized  as  a "txip-down"  approach;  the 
principal  thrust  is  successive  definition  of  all  conceivable 
failure  events  at  the  system  level,  the  subsystem  level,  and 
on  down  to  the  component  failure  mode  level.  FMECA  is 
"bottom-up"  and  is  conducted  principally  in  the  inverse  order 
by  identifying  component  failure  modes  and  tracing  their 
consequences  up  through  the  system. 
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In  principle,  the  results  of  FTA  and  FMECA  should  be 
equivalent;  experienced  analysts  frequently  alternate 
between  top-down  and  bottom-up  modes  in  the  process  of  ana- 
lyzing a system. 

Selection  Rationale.  The  FTA  approach  was  selected  as  the 
framework  for  the  systems  level  assessment.  Its  principal 
advantages  included: 

. Display  of  functional  relationships  among  system 
elements  in  a graphic  form  readily  understood  by 
engineers  and  analysts. 

. Ready  assimilation  and  application  by  systems 
analysts 

. Ready  isolation  of  similarities  and  differences 
among  competing  system  configurations 

. Easily  converted  into  algebraic  models 

. Development  of  a fault  tree  need  be  carried 
down  only  to  the  level  at  which  failure  rate 
information  is  available. 

With  respect  to  the  last  item,  the  fault  trees  pre- 
sented in  the  results  section  of  this  report  were  developed 
beyond  the  available  failure  rate  information.  The  analysis 
was  continued  in  this  manner  to  reflect  qualitative  failure 
mode  information  and  to  accommodate  failure  rate  data  (or 
assessments)  that  may  result  from  on-going  testing  and  develop 
mental  efforts. 

A further  advantage  was  realized  by  emphasizing  func- 
tional (system-oriented  rather  than  hardware  oriented) 
failure-event  definitions  in  the  upper  levels  of  the  fault 
trees.  This  yielded  upper  portions  of  the  trees  that  could 
be  common  to  a number  of  alternative  system  configurations. 
(Lower  portions  of  fault  trees  are  inherently  applicable  to 
specific  components  types  regardless  of  usage) . Fault 
tree  modification  to  represent  an  alternative  system  con- 
figuration would  then  entail  major  changes  only  in  the 
intermediate  levels  of  the  tree.  This  implied  reduced  effort 
for  multiple  analyses,  and  thus,  greater  flexibility. 
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RESULTS 


The  results  of  this  reliability  modeling  study  are 
three  fold:  the  component  and  failure  mode  reliability 

models,  the  systems  analyses  usinq  the  fault  tree  framework 
and  the  mathematical  tools  developed  to  support  the  assess- 
ment process.  Examples  of  methodology  application  are  pro- 
vided in  Appendix  A. 


COMPONENT  RELIABILITY  MODELS 

The  total  number  of  models  developed  including  failure 
mode  partitioning  was  nearly  one  hundred.  This  was  an  un- 
wieldy number  for  presentation  in  tabular  form.  Therefore, 
the  following  uniform  format  was  used  for  each  component. 

Component  Title  and  Description.  The  component  was  identi- 
fied and  a brief  description  of  the  approach  used  and  the 
applicable  failure  modes  was  provided. 

Component  Reliability  Model.  The  component  .Level  reliability 
model  was  presented  and-  all  the  parameters  defined. 

Failure  Rate  Uncertainty  Distribution  Model.  The  distribu- 
tion  was  identifiecTand  its  principal  paranu  ters  (coefficient 
of  variation,  mean  ar<l  standard  deviation)  were  quantified. 

For  car^s  where  multiple  failure  rates  were  present  in  the 
model,  uncertainty  model  parameters  were  developed  and  pre- 
sented for  each  rate. 

It  must  be  noted  that  the  failure  rate  uncertainty 
distribution  model  can  be  applied  directly  to  constant 
failure  rates , X , only.  For  those  models  using  increasing 
failure  rates,  the  uncertainty  distribution  is  implicitly 
presented  through  the  upper  and  lower  bound  values  of  a and 
its  equivalent  mean  and  median. 

Failure  Rate  Mean  and  Bounds.  The  5%  Lower  Bound,  Median, 
Mean  and  95%  Upper  Bound" are  presented  for  each  of  the 
failure  rates,  X , (or  s'rile  factors,  a , in  the  component 
model. 

Partition  by  Failure  Modes.  For  each  of  the  identified  modes, 
the  model,  the  failure  rates  (or  scale  factors)  and  the  Mean 
and  Bounds  are  given  in  the  format  used  at  the  component 
level. 
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ELECTRIC  PROPULSION  COMPONENTS 
RELIABILITY  MODELS 
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INDEX  TO  ELECTRIC  PROPULSION 
RELIABILITY  MODELS 

Page 

Number 

Power  Conditioners/Converters  (PC C)  1-55 

PCC  Switch  1-63 

Unpressured  Surface  Tension  Tank  (Cesium)  1-65 

Trapped  Gas  In  Reservoir  (Cesium  Ion  Only)  1-68 

Pressurized  Tank  1-69 

Elastomeric  Bladder/Diaphragm  1-71 

Fill  Valve  (Cesium  Ion  System)  1-72 

Fill  Valve  1-74 

Heaters  (Line,  Tank  and  Valve)  1-76 

Vapor  Valve  (Cesium)  1-77 

Isolator  1-79 

Vaporizer  1-81 

Vaporizer  Heater  1-84 

Hollow  Cathode  1-86 

Discharge  Chamber  (Kaufman  Type)  1-88 

Discharge  Chamber,  MESC  1-91 

Neutralizer  Assembly  1-94 

Thrust  Vectoring  Assembly  (TVA)  1-96 

Spark  Initiator  1-100 

Energy  Storage  Capacitor  1-102 

Main  Electrodes  1-104 
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Page 

Number 

Negator  Spring  1-105 

Propellant  Bellows  Reservoir  (Colloid)  1-106 

Fill  Valve  (Colloid  System)  1-108 

Propellant  Filter  1-109 

Control  Bellows  (COLLOID)  1-111 

Ball  Valve  (Colloid  System)  1-112 

Zeolite  Cannister  1-114 

System  Propellant  Manifold  1-115 

Electrof luidJ c Isolation  Valve  1-116 

Thruster  Frame  1-118 

Thruster  Module  1-119 

Filament  Neutralizer  1-121 


POWER  CONDITIONERS/CONVERTERS  (PCC) 


As  stated  in  preceding  sections  of  this  report  the 
piece  parr  approach  MIL-HDBK  217B  was  used  in  assessing  the 
reliability  of  electronic  assemblies.  This  approach  used 
without  modification  yields  simply  point  estimates  of 
failure  rates.  Since  it  is  known  that  actual  failure  rates 
vary  significantly  the  resulting  uncertainty  surrounding  the 
point  estimate  had  to  be  addressed.  From  the  arguments 
presented  in  the  Electronic  Components  and  Assemblies  Section, 
the  log  normal  distribution  with  coefficient  of  variation 
V = 1.655  was  chosen  to  model  the  uncertainty  at  the 
component  level. 

Aggregation  of  this  uncertainty  to  the  PCC  level 
followed  the  following  process: 

1.  Determination  of  component  variance  - From  the  MIL-HDBK 
217B  assessment  the  expected  value  of  the  component  rate 
E jxj  was  obtained.  The  variance  was  calculated  using  the 
relationships 

V = E^  jxj  and  as  discussed  above 

*1  = 1.655, 

V * 2.74  E2  j*| 


2.  Variance  Aggregation.  This  process  followed  two  paths. 
For  identical  components 

Total  V = (V^” 

For  dissimilar  components 

Total  V = £n  V. 

c*l 

Representation  of  the  PCC  level  failure  rate  and 
variance  in  the  form  chosen  for  other  components  used  the 
same  relations  set  forth  at  the  start  of  this  section. 
Uncertainty  distribution  parameters  were  given  by 


1-55 


£ 


a2pcc 


Failure  rate  bounds  and  central  measures  were  obtained  from 


Median  = x.5  = exp  ( Mpcc) 

5%  Lower  Bound  = x.05  = exp 

95%  Upper  Bound  = x.  95  = exp 


The  results  presented  for  the  Cesium  Ion,  Colloid  and 
Pulsed  Plasma  PCC  were  obtained  by  analysis  of  available 
parts  lists  of  the  system  (13,  14,  15);  grouping  of  parts 
by  subassemblies  was  available  only  for  the  Pulsed  Plasma 
System  (Ref  7) , Therefore,  only  this  system  shows  entries 
in  the  fault  tree  below  the  PCC  level. 

The  results  shown  for  the  Mercury  Ion  PCC  are  taken 
from  a recently  completed  study  performed  by  Hughes  Research 
Lab  for  Lewis  Research  Center  (Ref  16).  While  parts  lists 
were  not  available  for  this  study,  the  results  presented  in 
Ref  16  were  obtained  using  the  MIL-HDDK  217B  approach.  This 
satisfied  our  requirement  for  E jx  but  left  no  direct 

method  for  assessing  the  variance  associated  with  E j X p(,J. 
Since  the  Cesium  Ion  System  is  also  an  Electron  Bombardment 
Ion  System,  with  similar  thrust  levels  and  mission  profiles, 
the  variance  calculated  for  that  PCC  was  arbitrarily  assigned 
to  the  Mercury  Ion  PCC. 


( PCC  (Mercury  Ion  System) 

Component  Reliability  Model 

R = exp  (-  X t)  where  t --  mission  time 

(elapsed  mission  hours) 
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Failure  Rate  Uncertainty  Distribution  Model 


Log  Normal 

Coefficient  of  Variation 

t)  = 2.341 

Mean 

V = -15.61 

Standard  Deviation 

a = 1.367 

Failure  Rate  Mean  and  Bounds 


5%  Lower  Bound 

Median 

Mean 

95%  Upper  Bound 

a.05 

A.5 

e|x| 

A.  95 

0.0175 

0.166 

0.422 

1.57 

x 10"6 

per  hour 

PCC  (Cesium  Ion  System) 

Component  Reliability  Model 

R = exp  (-  \ t)  where  t = mission  time 

Failure  Rate  Uncertainty  Distribution  Model 
Log  Normal 


Coefficient 

of  Variation 

T)  » 

0.915 

Mean 

V = 

-13.18 

Standard  Deviation 

(7  - 

0.78 

Failure  Rate  Mean 

and  Bounds 

5%  Lower  Bound 

Median 

Mean 

95% 

Upper  Bound 

a.05 

A.  5 

e!M 

A.  95 

0.  52 

1.  88 

2.55 

6.79 

x 10"6 

per  hour 
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PCC  (Colloid  System) 


Component  Reliability  Model 

R = exp  (-  A t)  where  t = mission  time 

Failure  Rate  Uncertainty  Distribution  Model 


Log  Normal 

Coefficient  of  Variation 

V = 

1.655 

Mean 

M = 

-13.91 

Standard  Deviation 

cr  = 

1.148 

Failure  Rate  Mean  and  Bounds 


5%  Lower  Bound 

Median 

Mean 

95% 

Upper  Bound 

in 

o 

• 

K 5 

Ej\| 

A. 95 

0.138 

0.91 

1.758 

6.01 

,-6 

x 10  per 

hour 

Control  Logic  (Pulsed  Plasma) 
Component  Reliability  Model 

R = exp  (-At)  where  t = operating  time 

Failure  Rate  Uncertainty  Distribution  Model 
Log  Normal 

Coefficient  of  Variation  H = 0.2095 

Mean  M = -13.47 

Standard  Deviation  <1  = 0.2073 
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Failure  Rate  Mean  and  Bounds 


5%  Lower  Bound 

Median 

Mean 

95% 

Upper  Bound 

m 

o 

*<* 

*.  5 

EW 

*.95 

1.01 

1.42 

1.45 

2.0 

x 10"6 

per  hour 

Low  Voltage  Converter  (Pulsed  Plasma) 

Component  Reliability  Model 

R = exp  (-At)  where  t = operating  time 

Failure  Rate  Uncertainty  Distribution  Model 


Log  Normal 

Coefficient  of  Variation 

V = 0.5772 

Mean 

f*  = -13.6 

Standard  Deviation 

cr  = .536 

Failure  Rate  Mean  and  Bounds 

5%  Lower  Bound  Median 

Mean  95%  Upper  Bound 

*.05  *.5 

E | A | *.95 

0.516  1.247 

1.44  3.01 

x 10  6 per  hour 

High  Voltage  Converter  (Pulsed  Plasma) 

Component  Reliability  Model 

R = exp  (-  At) 

where  t = operating  time 

1-59 


Failure  Rate  Uncertainty  Distribution  Model 


Log  Normal 


Coefficient 

of  Variation 

n = 0.322 

Mean 

H = -13. 37 

Standard  Deviation 

cr  = 0.314 

Failure  Rate  Mean 

and  Bounds 

5%  Lower  bound 

Median 

Mean 

95% 

Upper  Bound 

*.05 

*.  5 

e|a( 

*.  95 

0.93 

1.56 

1.64 

2.62 

ln-6 

x 10  per 

hour 

System  Power  Converter  (Pulsed  Plasma) 

Component  Reliability  Model 

R - exp  (-  X t)  where  t = operating  time 

Failure  Rate  Uncertainty  Distribution  Model 


Log  Normal 

Coefficient  of  Variation 

= 

0.594 

Mean 

M = 

-13.67 

Standard  Deviation 

* 

C T = 

0.55 

Failure  Rate  Mean  and  Bounds 

5%  Lower  Bound  Median 

Meaa 

95% 

Upper  Bound 

*.05  *.5 

Ejx| 

*95 

0.466  1.15 

1.  34 
x 10-6 

per  hour 

2.85 
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Sense  Circuit  (Pulsed  Plasma) 


Component  Reliability  Model 


R = exp  (-  \ t) 


where  t = operating  time 


Failure  Rate  Undertainty  Distribution  Model 
Log  Normal 

Coefficient  of  Variation  *1  = 3.14 


Mean 


M=  -15.43 


Standard  Deviation 


o - 1.54 


Failure  Rate  Mean  and  Bounds 


5%  Lower  Bound 


Median 

x.15 


Mean 


95%  Upper  Bound 


0.0157 


0.199 


.649 


x 10  per  hour 


Pulse  Buffer  (Pulsed  Plasma) 


Component  Reliability  Model 


R = exp  (-  X t) 


where  t = operating  time 


Failure  Rate  Uncertainty  Distribution  Model 


Log  Normal 


Coefficient  of  Variation 


n = 0.3675 


Mean 


M = -14.007 


Standard  Deviation 


o = 0.3559 
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Failure  Rate  Mean 

and  Bounds 

5%  Lower  Bound 

Median 

Mean 

95%  Upper  Bound 

x.05 

x.  5 

e!M 

x.  95 

0.46 

0.826 

.828 

1.48 

x 10"6  per 

hour 
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PCC  SWITCH 


While  this  component  had  not  been  defined  as  part  of 
the  system  to  be  assessed,  the  use  of  redundant  PCC's  imply 
its  use.  Since  all  the  electric  propulsion  systems  assessed 
included  redundant  PCC’s,  the  PCC  switch  was  included.  Its 
function  is  analyzed  in  the  fault  trees  for  each  system. 

The  identified  failure  modes  for  the  switch  are  failing 
active  and  passive.  The  former  implies  a failure ^during 
the  switching  process  leaving  neither  PCC  connected  to  the 
propulsion  system.  The  fail  passive  mode  implies  failure 
to  switch,  leaving  the  PCC/thruster  configuration  existing 
upon  initiation  of  the  switch  command  unchanged. 


Component  Reliability  Model 

R = exp  (-  \ N)  where  N = operating  cycles 

Failure  Rate  Uncertainty  Distribution  Model 


Log  Normal 

Coefficient  of  Variation 
Mean 

Standard  Deviation 

Failure  Rate  Mean  and  Bounds 
5%  Lower  Bound  Median 

*.05  *.5 

0.0094  0.062 


V = 1.66 


-16.6 

or  = 1.15 

Mean  95% 

Upper  Bound 

eM 

\ 95 

0.12 

0.41 

10  6 per  cycle 
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Partition  to  Failure 


1.1  Model 


R = exp  {-  x t) 

I- 2 Failure  Rate 

E jxAj  = 50%  e{a} 

1,3  ^iiH£e_Rate  Means  and  r 


5%  Lower  Bound  Median 


0.00025 


2 . 1 Mode  1 


0.0024 


Mean  95%  Upper  Bound 


0.022 

x!0~6  per  cycle 


0.06 


K = exp  (-  \ t) 

2 • 2 - Pal  lure  _ R ate 

E jxAj  = 50%  E{X} 

2 ' 3 ra-iIyie_Rate  Means  ancMBo un ds 


5%  Lower  Bound  Median 


Mean  95%  Upper  Bound 


0.00025 


0.0024 


0.06 


0.022 


xlO  6 per  cycle, 
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UNPRESSURED  SURFACE  TENSION  TANK  (CESIUM) 


The  contribution  due  to  corrosion  is  an  age-dependent 
phenomenon  that  occurs  only  in  a reservoir  subpopulation  in 
which  efforts  to  prevent  carbon  precipitation  have  been 
unsuccessful;  the  mean  life  for  this  subpopulation  appears 
to  be  on  the  order  of  10,000  hours*.  A normal  distribution 
is  an  appropriate  model  for  the  subpopulation. 

Even  if  the  two  life-distribution  models  are  considered 
"known",  there  are  four  uncertain  parameters: 

. The  constant  failure  rate,\ 

. The  mean  of  the  normal  distribution  (we  shall  use 
to  distinguish  this  from  the  lognormal  uncer- 
tainty distribution  parameter, p ) 

. The  standard  deviation  of  the  normal  distribution, 
c' 

. The  relative  size  of  the  subpopulation,  K. 

It  would  be  meaningless  to  consider  uncertainty  in  each  of 
these  parameters  with  available  data  and  insight.  Instead, 
fixed  estimates  will  be  used  for  two:  n'=  10,000  hours, 

a'  = 1,500  hours.  Noting  that  the  noncorrosion  failure 

rate  has  the  expected  value  E ) A [ = 1.5  x 10  ^ and  applying 

the  3.6  x 10  estimate  as  an  equivalent  expected  failure 
rate  at  10,000  hours,  we  obtain 

e-10,000  x 1.5  x 10~6  _ [x  ^ . 5E  |k | ] = e'10,000  x 3,6  10 

eJk| « . 04 


*See  ref  17,  18,  19,  20,  21,  22 
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Component  Reliability  Model 


R^t)  = e 

'X{l-i)t  . 

(i-R  d_i) ) N (t) 

is  the  overall  model, 

which  yields 

the  following 

for 

selected 

values  of  t: 

t 

R0.05(t) 

RE(t) 

R0.5{t) 

R0.95(‘ 

5,000 

0.999 

0.995 

0.993 

0.977 

10,000 

0.996 

0.972 

0.965 

0.912 

15,000 

0.993 

0.949 

0.939 

0.849 

20,000 

0.992 

0.944 

0.932 

0.830 

50,000 

0.987 

0.918 

0.891 

0.722 

87,000 

0.980 

0.886 

0.842 

0.607 

Failure  Rate  Uncertainty 

Distribution 

Parameters 

Coefficient 

of  Vari 

ation  f)  = 1.25 

Mean 

M = -0.065 

Standard  Deviation 

o = 0.97 

Bounds  and 

Central 

Measures  (xlO-^  per  hr.) 

5%  Lower  Bound 

Median 

Mean  95%  Upper  Bound 

X.05 

A.05 

E { A | A. 95 

0.19 

0.94 

1.5  4.63 

The  uncertainty  about  K will  be  described  by  a beta 
distribution : 


P 


(x  s;  C ) = 


r (50) 

r(2)  r (48) 


(1  - X)47  dx 
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Subpopulation  relative  size  pounds  and  central 
measures  (xlO  6 per  hour) 


5%  Lower  Bound  Median  Mean  95%  Upper  Bound 

K0. 05  = °'004  K0. 5 = 0,038  EjK(  = 0,04  K0.95  = 0.09 


Since  it  is  likely  that  A and  K are  strongly  correlated 
(because  both  are  determined  by  design  and  process  controls) , 
we  may  treat  K^as  being  associated  with  A^.  For  notational 

convenience,  let  N(t/  denote  the  complement  of  the  normal 
cumulative  probability. 


Partition  to  Failure  Modes 


1.2 


1.3 


Tank  Leakage 

Assessed  at  40%  of  all  tank  failures, 
reliability 

= / \*4 
R Leak  ~ (^RTank  Total  ) 

Tank  Fins  Unwetting 

Assessed  at  40%  of  all  tank  failures, 
reliability 


R 


(Fins) 


= /R 


.4 


Tank  Totax 


Trapped  Gas 

Assessed  at  20%  of  all  tank  failures, 
reliability 

RGas  (R  Tank  Total) 


In  terms  of 


In  terms  of 


In  terms  of 
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TRAPPED  GAS  IN  RESERVOIR  (Cesium  Ion  Only) 


This  condition  is  not  clearly  assessable  to  one 
component  bur  rather  to  two.  During  the  interval  between 
tank  charging  and  orbit  insertion  gas  trapping  is  possible. 
It  may  result  from  a tank  leak  or  a fill  valve  leak.  The 
details  of  each  of  these  component  failure  modes  are 
assessed  under  the  appropriate  component.  The  resulting 
composite  model  is  presented  below: 


Component  Reliability  Model 


R =■  R (fill  valve  gas  leakage)  x R (tank  gas  leakage) 


R 


tank  gas  leak 


(see  cesium  reservoir 


R (fill  valve  = exp)  (-ALt) 


then 


» 


R = 


Rtank  l'2  x exPl'V’ 
total. 


where  t = mission  hours 

L = leakage  failure  rate 
(see  fill  valve  for  values) 


V 


v 
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PRESSURIZED  TANK 


The  failure  inodes  for  this  component  are  rupture  and 
leakage.  Most  imperfections  will  be  minute,  leading  to 
leak  failure  rather  than  rupture  (a  distribution  of  80% 
leak  failure  and  20%  rupture  failure  is  indicated) . Typi- 
cal failure  locations  include  diaphragm  (cr  bladder)  and 
tank  interface,  valve  and  tank  interface,  and  welded 
joints.  The  principal  failure  mechanisms  include  handling 
and  workmanship  and  corrosion.  Metal  fatigue  has  also  been 
suggested  as  a possible  mechanism  of  lower  importance. 


Component  Reliablity  Model 


R = exp  (-At) 


where  t = pressurized  time 
A = failure  rate 


Failure  Rate  Uncertainty  Distribution 


Log  Normal 

Coefficient  of  Variation 

V -■  2.5 

Mean 

P = -16.27 

Standard  Deviation 

a = 1.4075 

Failure  Rate  Mean  and  Bour.ds 

5%  Lower  Bound  Median 

Mean 

95%  Upper  Bound 

X.05  \ 5 

EjA) 

\ 95 

.0085  0.086 

.231 

CO 

• 

X10~6per  hour 
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Partition  by  Tank  Halves  (to  accommodate  tank/bladder  systems) 


1.  Propellant  Half  Failure 

1.1  Model  R=  exp(-At) 

1.2  Failure  Rate 

E |xprop}  ~ -lxl 

1.3  Failure  Rate  Mean  and 

5%  Lower  Bound  Median 

x.05  X.5 

0.0022  0.032 

2.  Pressurant  Half  Failure 

2.1  See  1.1 

2.2  See  1.2 

2.3  See  1.3 


Bounds 

Mean 

95%  Upper  Bound 

EIM 

x.4f- 

0.116 

0.452 

X10  ^ per  hour 

1-70 


ELASTOMERIC  BLADDER/DIAPHRAGM 


While  the  pressure  in  the  propellant  reservoir  of  the 
mercury  ion  system  is  similar  to  that  in  the  thermochemical 
systems,  the  materials  compatibility  was  assessed  as  being 
the  principal  device  in  determining  the  reliability  model 
for  the  bladder.  While  virtually  no  failure  rate  data  exists 
for  bladders  of  similar  service,  reliability  assessmen  3 
of  this  situation  have  been  performed  (Ref  23).  The  point 
estimate  failure  rate  cited  in  Ref  23  shall  be  used  as  the 
starting  point  for  this  model.  Since  Ref  23  does  not  assess 
uncertainty,  the  uncertainty  model  for  the  thermochemical 
bladder  will  be  used. 

Failure  modes  for  these  expulsion  devices  are  leakage 
and  rupture,  which  are  caused  by  (1)  imperfections  in 
materials  and  fabrication,  and  (2)  folding  tears. 


Component  Reliability  Model 

R = exp (-At)  where  t = pressurized  time 

Failure  Rate  Uncertainty  Distribution 
Log  Normal 


Coefficient  of  Variation 

n = 

0.75 

Mean 

M * 

-16.08 

Standard  Deviation 

a = 

0.668 

Failure  Rate  Mean  and  Bounds 

5%  Lower  Bound  Median 

Mean 

95*4 

Upper  Bound 

*.05  \ 5 

e{\} 

*.95 

0.035  0.104 

0.1" 

0.312 

x 10"6 

per  hour 
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FILL  VALVE  (Cesium  Ion  System) 


The  similar  pressures  and  mission  times  allow  the  use 
of  the  thermochemical  fill  valve  model  in  the  mercury  ion 
system.  The  cesium  fill  valve  presents  a different  situation. 
During  the  period  between  tank  charging  and  orbit  insertion 
this  valve  experiences  a pressure  differential  opposite  to 
that  of  the  fill  valve  in  the  above  mentioned  system.  After 
orbit  insertion  the  pressure  differential  is  negligible  and 
ceases  to  be  of  concern  as  a failure  mechanism.  This  dual 
mode  of  operation  is  reflected  in  the  selected  reliability 
model.  Because  of  the  long  duration  at  very  low  pressures 
the  starting  point  for  this  model  was  the  colloid  fill 
valve. 


Component  Reliability  Model 

R = exp[-  A _t  -A,  t ] where  \n  - gas  leak  fail 

G ° 11  m G rate 

to  = elapsed  time 

between  pressuri- 
zation and  orbit 
insertion 

A^  = propellant  leak 
fail  rate 

tm  = mission  duration 


Failure  Rate  Uncertainty  Distribution  Model 


G 

1.91 


Log  Normal 

Coefficient  of  Variation 
Mean  -12.81 

Standard  Deviation  1.24 


L 

1.91 

-15.69 

1.24 
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Failure  Rate  Mean  and  Bounds 


5%  Lower  Bound 

Median 

Mean 

95% 

Upper  Bound 

A nc 
. 05 

X.5 

EW 

X .95 

XG  0.356 

2.7 

5.9 

21.0 

X 0.02 

0.153 

0.33 

1.18 

i 

x 10  6 per 

hour 

Partition  to  Failure 

Modes 

1. 


2. 


Propellant  Leakage 

1.1  Model 

R = exp  (-  A Lt) 

1.2  Failure  Rate 


t = mission  hours 


E {al}=  0.33  x . 5~6  per  hour 

1.3  Failure  Rate  Mean  and  Bounds 


Lower  Bound 

Median 

Mean 

95%  Upper  Bound 

x.05 

a.5 

E W 

X . 95 

0.02 

0.153 

0.33 

1.18 

xlO  ^ per  hour 


Gas  Leakage  to  Tank 

2. 1 Model 

R = exp  (- a Gt) 

2.2  Failure  Rate 

E A„  = 5.9  xlO 


-6 


t = time  elapsed  between  tank 

charging  and  orbit  insertion 


per  hour 


2 . 3  Failure  Rate  Mean  and  Bounds 
5%  Lower  Bound  Median  Mean 
0.356  2.7  5.9 


95%  Upper  Bound 
21.0 


xlO  ® per  hour 
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FILL  VALVE 


This  component  is  used  to  introduce  the  pressurant  or 
propellant  into  its  storage  tank.  Upon  completion  of  fluid 
loading  the  valve  is  closed  and  if  launch  occurs  on  schedule 
it  remains  in  this  position  throughout  the  remainder  of  the 
mission.  Failure  modes  of  this  component  are  rupture  and 
internal  leakage  of  the  valve  seat.  Rupture  can  be  caused 
by  flaws  appearing  randomly  in  the  material  and  by  stresses 
during  launch.  Redundancy  for  this  component  is  achieved 
by  capping  with  valve  closure  caps: 


Component  Reliability  Model 

R = exp(-,\t)  where  t = pressurized  time 

\ = failure  rate 


Failure  Rate  Uncertainty  Distribution 


Lognormal 

Coefficient  of  Variation  *7  = 10.5 

Mean  ^ * -16.21 

Standard  Deviation  cr  = 2.i7fl3 


Valves  in  general  are  exposed  to  repeated  cyclic  oper- 
ation and  their  reliability  models  reflect  the  situation 
with  cyclic  dependent  functions  that  can  often  drive  the 
overall  expression.  Fill  valves  however,  can  be  expected 
to  be  cycled  only  a few  times  in  system  pressure  tests  and 
finally  once  more  upon  charging  the  propellant  storage  tank 
prior  to  launch.  It  will  then  become  a passive  component 
of  the  system;  expected  to  last  th?  mission  in  the  finally 
closed  condition.  Therefore  its  reliability  model  includes 
a time  dependent  function  only.  The  deleterious  effects 
of  test  cycling  prior  to  final  charging  are  included  in  the 
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developed  failure  rate  to  be  applied  throughout  the  mission 


Failure  Rate  Mean  and  Bounds 


5%  Lower  Bound 

Median 

Mean 

95% 

Upper  Bound 

\ 05 

\5 

E|*( 

X.95 

.003 

0.091 

.09 

.323 

X1Q~6 

per 

hour 
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HEATERS  (LINE,  TANK  AND  VALVE) 


Heaters  of  this  type  employed  in  electric  systems  are 
used  in  duty  cycles  and  environments  very  similar  to  those 
employed  in  thermochemical  propulsion  systems.  This  led  to 
the  use  of  the  same  reliability  model  and  parameter  and 
values  as  used  in  the  thermochemical  propulsion  system;  see 
that  section  for  further  discussion  of  this  heater  type 
(page  1-153)  . 


Component  Reliability  Model  (unchanged) 


r =exp("  At) 


where  A = failure  rate 
t = Mission  time 


Failure  Rate  Uncertainty  Distribution 
Lognormal 

Coefficient  of  Variation  V = 2.016 

Mean  H = -17.68 

Standard  Deviation  o'  = 1.274 


Failure  Rate  Rounds  and  Central  Measures 


5%  Lower  Bound 

Median 

Mean 

95% 

Uppe*-  Bound 

\ 05 

\5 

E{X) 

\ 95 

.0026 

0.0209 

.047 

.169 

X10"6 

per 

hour 
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VAPOR  VALVE  (CESIUM) 


The  principal  working  elements  of  the  vapor  valve  are 
bimetallic  washers  designed  to  produce  a valve  opening  at 
temperatures  above  100°C.  These  washers  can  function  as 
designed  only  if  the  bond  of  the  dissimilar  materials  is 
preserved  over  an  extended  period  under  the  corrosive  action 
of  cesium  propellant.  Obstacles  to  thorough  reseating 
appear  improbable. 


Component  Reliability  Model 

R = exp (-At)  where  t = operating  time 

Failure  Rate  Uncertainty  Distribution  Model 


Log  Normal 

Coefficient  of  Variation 

n = 

1.7 

Mean 

n = 

-12.59 

Standard  Deviation 

cr  = 

1.165 

Failure  Rate  Mean  and  Bounds 


5%  Lower  Bound 

Median 

Mean 

95%  Upper  Bound 

\05 

*.5 

e{a[ 

\ 95 

0.5 

3.  4 

6.7 

23.1 

x 10  6 per  hour 
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Partition  to  Failure  Modes 


1.  Fail  Open 

1.1  Model 

R = exp  (- \t ) where  t = operating  time 

1.2  Failure  Rate 


E{Ao}  = 1/3  EtM 


1.3 

Failure 

Rate  'Mean  and  Bounds 

5%  Lower  Bound  Median  Mean 

95%  Upper  Bound 

A.  05 

A . 5 e|x| 

A.  95 

0.06 

0.72  2.23 

8.6 

x 10  6 per 

hour 

Fail 

Closed 

•N 

z.l 

Model 

(see  1.1) 

2.2 

Failure 

Rate  (see  1.2) 

2.3 

Failure 

Rate  Mean  and  Bounds 

(see  1.3) 

Fail 

Partial 

3 . i 

Model 

(see  1.1) 

3.2 

Failure 

Rate  (sec  1.2) 

3.3 

Failure 

Rate  Mean  and  Bounds 

(see  1. 3) 

1-78 


ISOLATOR 


The  CIV*assembly  incorporates  the  main  isolator  to 
decouple  the  thruster  high  voltage  from  the  propellant  feed 
system.  The  propellant  feed  lines  are  potential  conductors 
that  could  parallel  a short  across  all  units  on  a common 
feed  system.  In  one  current  design,  isolation  enables  the 
single  reservoir  tc  supply  the  main  and  neutralizer  cathodes. 
Endurance  tests  totaling  over  17,000  hours  indicate  that 
failure  modes  mav  include  insulation  breakdown  due  to 
both  metal  deposits  and  ceramic  failure  (24,  25,  26).  The 
mechanism  of  differential  thermal  expansion  described  for  the 
vaporizer  disk  may  be  applicable  to  the  ceramic  spacers. 

Guidance  on  estimating  an  isolator  failure  rate  is 
gained  by  noting  that  some  capacitors  utilize  similar  mate- 
rials for  an  analogous  function,  at  least  to  the  extent  of 
insulating  against  leakage  current, 

The  available  data  suggest  an  equivalent  failure  rate, 

E jx|  = 4.6  x 10~6,  which  is  a somewhat  conservative  estimate. 
Leakage  current  data  suggest  an  autocatalytic  type  of 
process,  consistent  with  knowledge  about  basic  phenomena: 
the  negatiye  temperature  coefficient  of  resistance  in 
ceramics  leads  to  channeling  of  leakage  current  and 
potentially  to  thermal  runaway.  A Weibull  model  with 
shape  parameter  /3  = 2 appears  appropriate. 


Component  Reliability  Model 

operating  time 
shape  factor,  set 
equal  to  2,  based  on 
similarity  of  isolator 
to  ceramic  capacitor 
scale  factor 

The  failure  rate  ( \=  4.6  x 10  per  hour)  is 
intended  for  use  in  an  exponential  model.  Transition  to 
a Weibull  model  was  obtained  by  setting  both  models  equal 
at  a selected  value  of  operating  time,  t.  Using  8 cm  test 
history  as  a guide  a value  of  t = 6,000  was  used. 

* 

Cathode-I  sola  tor-Vaponzer 


R = exp 


_t^ 

O' 


where  t 
P 


a = 
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Then; 

-At:  r t2 

e = exp  [— ] 

taking  the  logrithms,  t* 

a 

and  at  t = 6,000  hours, 

a = 6 , 000 
A 

Failure  Rate  Uncertainty  Distribution  Model 
Log  normal 

Coefficient  of  variation  rj  = 13.08 
Mean  n = 0.2036 

Standard  deviation  u - 1.626 


Weibull  Parameter  Values  and  Bounds 
Shape  Parameter,  /3  = 2 

Scale  Parameter,  a,  Equivalent  Mean  and  Bounds 
5%  Lower  Bound  Equivalent  Mean  Median  95%  Upper  Bound 

aE 


a 


. 05 
3.374  x 10 


8 


1.305  x 10' 


a 5 


ot 


.95 


4.89  x 109  7.198  x 1010 
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VAPORIZER 


Several  modes  of  failure  for  the  vaporizer  plug  can  be 
visualized  (25,  26,  29).  During  application  of  heat  at  the 
periphery  of  the  porous  plug,  there  will  be  a transient 
period  when  the  outer  regions  are  warmer  than  the  core  with 
nonuniform  expansion  inducing  stresses.  The  same  will  happen 
during  cooling.  While  20,000  cycles  of  stress  is  not  a large 
number  and  reduces  the  fracture  point  of  a material  only 
slightly  below  its  zero-cycle  level,  the  nonuniform  wall 
structure  between  cells  could  be  vulnerable.  Then,  if  one 
or  a few  cell  walls  were  fractured,  the  nearby  walls  would 
take  higher  loads  and  a crack  could  propagate.  Vapor  flow 
through  the  cells  will  accelerate  the  process  due  to  the 
extremely  thin  walls  subjected  to  wear.  Should  malperfor- 
mance  of  the  vaporizer  heater  occur  and  produce  an  uneven 
temperature  distribution  in  the  porous  plug  housing,  there 
will  be  an  acceleration  of  the  tendency  of  the  plug  to 
develop  a crack.  The  consequences  of  this  type  of 
failure  vary  between  small  degradation  in  performance,  such 
as  a higher  flow  of  vapor  than  predicted,  and  or  catastrophic 
due  to  complete  loss  of  propellant.  The  distribution  of 
failures  under  this  mechanism  will  increase  with  the  number 
of  operating  cycles. 

The  porous  plug  can  also  develop  failures  analogous 
to  failures  of  liquid  and  gaseous  material  filters.  The 
failure  mechanism  is  a clogging  of  the  filter  passages  as 
foreign  matter  is  removed  from  the  material  being  filtered. 
Every  effort  is  expended  in  filtration  of  propellant  to  remove 
impurities  prior  to  reservoir  filling,  but  100-percent 
removal  may  not  be  achievable.  Impurities  could  migrate 
to  the  porous  plug  and  clog  passages,  thus  reducing 
propellant  flow  for  a given  setting  of  the  vaporizer. 

Another  possible  effect  observed  during  testing  was  that 
impurities  countering  the  nonwetting  property  of  liquid 
metal  against  tungsten  allowed  loss  of  propellant. 
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Component  Reliability  Model 


R = exp 


X t - A„ 
op  op  c 


N 


where  X = operating  time  failure 

rate 

cyclic  failure  rate 
operating  time 


op 


c = 


op 

N 


Failure  Rate  Uncertainty  Distribution  Model  (Applicable  to 
both  failure  rates) 

Log  normal 

Coefficient  of  Variation  V = 1.71 
Mean  ' V-  - -13.19 

Standard  Deviation  o = 1.168 

Failure  Rate  Mean  and  Bounds  (Cyclic  and  Time  Components) 


5%  Lower  Bound 

Median 

Mean 

95% 

Upper  Bound 

X.05 

x.5 

e|M 

\ 9 

*c 

0.273 

1.87 

3.69 

12.74 

^■op 

0.273 

1.87 

3.69 

12.74 

X10  ^ per 

hour 

(cycle) 

Partition  to  Failure  Modes 


1.  Clogging 

1.1  Model  R = exp  (-  t)  where  t = operating  hours 

A , = clogging  failure 
rate 

1.2  Failure  Rate 

E|  Xclj  = 25*  Ejxj 

1.3  Failure  Rate  Mean  and  Bounds 


Lower  Bound 

Median 

Mean 

95% 

Upper  Bound 

\ 05 

\ 5 

EIM 

A.  95 

0.019 

0.259 

0.923 

^.185 

XI o' 6 per 

hour 

2.  Excessive  Flow,  e.g.  Leaking,  Fracture 

2.1  Model  R = exp  [-  t - N] 

1 op  op  c 

2.2  failure  Rate 

eJa'  = 100%  E j Ac[ 

E 5A'op{  = Ehop| 

Failure  Rate  Mean  and  Bounds 


5%  Lower  Bound 

Median 

Mean 

95%  Upper  Bound 

A.  05 

\ 5 

Ejxj 

a.93 

0.273 

A c 

1.87 

3.69 

32.74 

A'  0.16 

A op 

1.25 

2.77 

9.96 

, n-6 

xlO  per 

hour 

(cycle ). 
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VAPORIZER  HEATER 


The  heating  coil  is  subject  to  failure  even  after  the 
design  is  qualified  for  the  application.  The  corrosion 
probit  m of  electrical  heaters  operating  in  oxidizing  atmos- 
pheres is  not  present  in  a spacecraft  ion  engine.  Never- 
theless, absolute  purity  of  the  heater  conducting  element 
is  impossible;  the  inclusions  can  be  a source  of  outgassing. 
The  cumulative  timewise  effect  is  that  enough  material  can 
be  lost  to  lead  to  a fracture.  Thermal  cycling  contributes 
to  this  mode  of  failure.  As  material  is  lost,  the  resistance 
of  the  heater  coilwillbe  increased,  and  propellant  flow 
control  will  be  more  difficult.  In  the  event  of  coil  fracture 
no  propellant  can  be  passed.  Failures  of  this  part  will  in- 
crease with  time  of  operation,  roughly  analogous  to  a fatigue 
phenomenon . 

For  the  vaporizer  heating  coil  the  NRN*  contains  the 
following  failure  rate: 

Heaters,  electrical-satellite:  0.450  + 375%,  -95%  per  10^ 
part-hours . 

The  variance  about  the  mean  value  is  greater  than  en- 
countered for  most  data.  However,  there  is  no  reason  to 
assume  that  any  of  the  heaters  in  the  failure  rate  data  base 
have  been  rated  more  or  less  conservatively  than  the  data 
for  the  vaporizer  heater.  The  present  application  does 
contain  a thermal  cycling  operation  that  could  accelerate 
the  deleterious  effects  of  undetected  flaws  in  material  or 
fabrication  (25,  26,  29).  In  fact,  an  open  circuit  failure 
occurred  during  cycle  and  life  testing  of  the  mercury  ion 
thruster  after  594  cycles,  which  resulted  in  a redesign  to 
alleviate  high  thermal  stresses.  Therefore,  an  estimate  is 
made  that  the  mean  failure  rate  for  the  heating  coil  in  the 
vapori/.er  application  will  be  75  percent  above  the  NRN  value: 

A = 0.79  per  10  part-hours. 

A straight  time  dependence  (constant,  failure  rate)  is 
suggested  for  the  heater.  There  will  be  an  expansion  in  the 
length  of  the  heater  coil  and  a possible  stress  cor.vlition 
because  of  a constrained  instal lation . However,  this  line 
of  reasoning  is  more  speculative  than  the  case  for  undetected 
i mper fections . 
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Component  Reliability  Model 

R = exp  (- X t)  where  t = operating  time 

Failure  Rate  Uncertainty  Distribution  Model 
Log  Normal 

Coefficient  of  Variation  V = 1.71 
Mean  M = -14.73 

Standard  Deviation  a = 1.168 


Failure  Rate  Mean  and  Bounds 


5%  Lower  Bound 


‘.05 


0.06 


Median 

\5 

0.40 


Mean 

e|»| 

0.79 
■>-6 


95%  UDper  Bound 
X 


.95 

2.73 


x 10  per  hour 
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HOLLOW  CATHODE 


Some  of  the  so-called  random  failures  that  might  occur 
prior  to  predicted  end  of  life  could  originate  in  materials 
and  fabrication.  The  electron  beam  welding  process  used 
for  joining  the  cathode  tip  to  the  body  has  been  known  to 
leave  particles,  which  later  become  free  of  the  parent 
metal.  In  swaging  the  keeper  cap  over  the  heater  shield, 
minute  cracks  may  be  introduced  which  become  evident  at  a 
later  point  in  the  operating  life.  The  application  of 
insulator  material  tu  the  heater  coil  and  carbonate  coating 
to  the  insert  may  produce  non-uniformities  which  become 
crack  originations  under  thermal  cycling.  Additionally , 
spot  welds  join  the  wire  connecting  the  foil  insert  uO  the 
cathode  body  (25,  26,  27,  28). 

It  must  be  assumed  that  before  development  is  complete, 
requirements  for  the  cathode  service  life  will  have  been 
demonstrated.  Because  failures  are  unpredictable,  they  may 
appear  at  the  end  of  the  useful  life  or  develop  prematurely. 
Similarly,  failures  may  be  due  to  imperfections  in  fabrication 
or  materials  as  discussed  previously. 

Electron  tubes  show  these  same  failure  characteristics. 
Examples  in  data  compilation  include  such  failure  items  as 
excessive  heat,  caused  by  arcing,  leading  to  melting  of 
insulator  material  at  base;  shorting  due  to  erosion  of 
particles;  hot  spots  in  filamentary  material  and  opens; 
and  low  electron  rates  due  to  cathode  material  deterioration. 
The  similarity  of  these  kinds  of  failures  to  potential 
thruster  cathode  failures  suggests  that  tube  failure  rates 
may  be  applicable.  In  particular,  the  operation  of  the  ion 
engine  has  been  likened  to  a magnetron  operated  at  current 
cutoff.  Several  sources  provide  failure  rates  for  this 
type  of  tube. 


Component  Reliability  Model 

R = exp  (-  At)  where  t = operating  time 

A = failure  rate 
per  hour 
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Failure  Rate  Uncertainty  Distribution  Model 


Log  normal 

Coefficient  of  variation 

00 

o 

m 

i — ( 

II 

pr 

Mean 

M=  -12.28 

Standard  Deviation 

cr  = 1.626 

Failure  Rate  Mean  and  Bounds 
5%  Lower  Bound  Median 


X 


.05 

0.32 


4.67 


Mean  95%  Upper  Bound 

EW  X.95 

17.5  67.7 

XI 0 ^ per  hour 
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DISCHARGE  CHAMBER  (Kaufman  type) 


The  production  of  ions  to  be  accelerated  and  focused 
into  an  ion  current  takes  place  in  the  discharge  chamber, 
sometimes  referred  to  as  an  ion  chamber.  Arbitrarily,  this 
assembly  will  be  defined  as  including  the  so-called  optics 
and  excluding  the  cathode  discussed  previously.  The  com- 
ponents comprising  the  discharge  chamber  assembly  are  outer 
shell,  thruster  endplate  (forward  end),  anode,  and  accelerator 
and  screen  grids. 

Endurance  testing  of  the  SIT- 8 unit  accumulated  7,400 
hours  with  229  startups.  A significant  interruption  occurred 
at  about  the  1000-hour  point  when  the  composite  graphite 
tantalum  baffle  delaminated  and  fractured  (26)  . This  item 
was  replaced  by  a redesigned  part  of  isotropic  graphite. 
Otherwise,  there  were  some  operational  anomalies;  for  example, 
the  accelerator  drain  current  became  roughly  half  its  initial 
value  before  steadying  while  there  was  an  increase  in  pro- 
pellant flow.  Measurements  on  weight  loss  (or  gain)  were 
made  during  halts  in  testing.  The  tentative  conclusion  at 
Lewis  Research  Center  appeared  optimistic  that  the  target  on 
useful  life  can  be  reached. 

Whil  • it.  does  not  constitute  a catastrophic  failure  in 
itself,  the  erosion  problem  may  produce  various  consequences. 
If  the  rate  of  erosion  can  be  controlled  and  the  parts 
experiencing  loss  of  material  are  proportioned  accordingly, 
there  will  be  only  a tolerable  loss  of  thruster  performance 
out  to  the  predicted  end  of  service  life.  However,  some 
researchers  have  reported  a rapid  increase  in  erosion  rates 
when  the  ICS'S  reaches  approximately  75  percent  of  the 
available  material  (30,  31,  32). 

There  is  a small  probability  that  a total  loss  of  thrust 
could  result  from  sputtering  erosion,  such  as  the  case  of  a 
particle  shorting  the  grids.  When  the  particle  is  metal,  a 
discharging  capacitor  has  been  used  to  cause  the  particle  to 
melt  and  remove  the  short.  Specific  design  measures  have 
been  taken  to  correct  known  or  suspected  points  of  vulner- 
ability to  the  effects  of  sputtered  particles.  The  neu- 
tralizer is  now  positioned  to  avoid  a recurrence  of  the 
accelerator  grid  erosion  experienced  during  flight  of  the 
15-cer.limeter  unit.  Sputter  shields  are  included  at  the  term- 
inals installed  on  the  endplate.  Insulating  materials,  such 
as  those  at  the  anode  shell  mount  and  the  accelerator  grid 
mount,  are  selected  as  appropriate  for  the  application. 
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The  conclusion  to  be  drawn  from  the  previous  discussion 
is  that  a structural  wear-out  mode  of  failure  will  be  the 
most  probable.  However,  other  failures  may  include  premature 
and  unpredicted  failures  of  a wear-out  type  together  with 
apparently  rand sm  occurrences  of  failure  due  to  fabrication 
or  material  imperfections.  The  observations  during  test 
periods  are  consistent  with  these  statements.  Additionally, 
by  examining  the  origins  of  the  failure  mechanism,  a simi- 
lar conclusion  can  be  reached.  The  parts  are  large  enough 
to  enable  fabrication  and  inspection  to  be  free  from  the  need 
for  absolute  perfection.  There  are  no  concentrated  heat 
sources  to  induce  the  thermal  gradients  and  cycling  that 
could  accelerate  the  anomalous  behavior  of  minute  imperfec- 
tions. The  problem  of  thermal  distortion  of  the  accelerator 
and  screen  grids  because  of  temperatures  higher  in  their 
central  regions  than  their  edges  has  been  solved  by  the 
dished  design,  at  least  for  the  period  before  deep  erosion. 

On  the  other  hand,  erosion  damage  is  inevitable.  The 
high  velocity  impact  of  charged  particles  on  the  walls  erodes 
the  metal  surfaces.  Sputter  yield,  that  .is,  the  number  of 
atoms  eroded  per  incident  ion,  has  been  studied  and  its  rates 
are  known.  However,  the  resulting  weight  loss  can  be  uneven 
and  lead  to  catastrophic  consequences.  In  other  cases,  it 
may  develop  that  lost  weight  and  thermal  gradients  during 
on-off  cycling  may  interact  to  steepen  the  gradients  and 
accelerate  the  fatigue-like  action  of  cycling.  Furthermore, 
the  material  loss  rate  is  widely  believed  to  accelerate  as 
it  progresses. 

The  flaking  problem  may  be  delayed  rather  than  completely 
cured  by  the  design  improvements.  Erosion  rates  may  be  slowed 
by  the  use  of  resistant  materials  and,  at  some  locations,  by 
further  protective  coatings.  Nevertheless,  the  buildup  on 
the  anode  and  its  screen  insert  can  be  expected  to  persist. 
Ultimately,  the  buildup  may  span  the  meshes  of  the  screen  and 
result  in  particles  produced  by  flaking,  which  may  be  as  large 
as  those  produced  before  design  improvements.  Another  benefic- 
ial procedure  consists  of  shot-blasting  the  anode  surface  to 
effect  better  adherence  of  sputtered  material. 
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Component  Reliability  Model 


R = exp  [-Xt  - 


( t-5000) 
a 


ft 


] 


where  \ = failure  rate  (per  operating 
hour) 

t = operating  time 
0 = 3.0 

Of  = Scale  Factor 


Fai lure  Rate  Uncertainty  Distri bution 
Log  Normal 

Coefficient  of  Variation  V = 3.8  6 

Mean  n ~ -14.79 

Standard  Deviation  <x  = 1.663 


Exponential  Component  Failure 

Rate  Mean 

and  Bounds 

5%  Lower  Bound 

Median 

Mean 

95%  Upper  Bound 

x.05 

x.  5 

e!M 

X . 95 

.024 

0.38 

1.5 

5.8 

x 10-6 

per  hour 

Weibull  Component  Parameter  Values  and  Bounds  * 

Shape  Factor,  d = 3.0 

Scale  Factor  a , Equivalent  Mean  and  Bounds 

5%  Lower  Bound  Mean  Median  95%  Upper  Bound 

a.  05  O'  “5  ' a.  95 

& 

1.146  x 1011  4.435  x 1011  1.767  x 1012  2.722  x 1013 


* The  same  relative  scale  was  applied  to  the  uncertainty 
distribution  for  a , bearing  in  mind  that  a is  analogous 
to  l/\ 
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DISCHARGE  CHAMBER,  MESC 


The  magnetoelectrostatic  plasma  containment  concept 
influences  the  form  of  the  discharge  chamber.  Bounding 
surfaces  of  the  discharge  chamber  act  as  a magnetic  wall  to 
reflect  most  of  the  ions  and  electrons  approaching  them. 

This  greatly  reduces  ion  losses  to  the  walls,  increases 
mass  utilization  efficiency,  and  provides  a uniform  plasma 
for  efficient  ion  extraction. 

Some  erosion  data  are  available  from  an  abbreviated 
life  test.  The  objective  of  the  test  was  18,000  hours,  but 
a termination  occurred  at  4348  hours  because  of  a failure 
of  the  neutralizer  cathode  heater.  The  accelator  electrode 
evidenced  erosion  on  the  downstream  face  by  charge  exchange 
ions  consisting  of  pits  about  0.1  inch  deep  and  a ring 
groove  about  the  radius  of  the  ground  potential  housing. 
Electrode  alignment  was  rated  excellent  because  the  pits 
were  symmetric  with  respect  to  the  apertures.  The  loss  due 
to  pits  and  the  ring  was  found  to  be  0.15  gram;  a further 
loss  of  0.24  gram  was  uniform  over  the  downstream  face,  for 
a total  of  0.39  gram  out  of  an  original  part  of  mass  of  30 
grams.  An  extrapolation  by  the  developers  based  on  steady 
erosion  indicated  that  penetration  would  occur  at  39,500 
hours.  It  is  also  possible,  however,  that  as  materia]  loss 
accumulated  beyond  an  operating  period  that  has  been  reached 
in  test  the  discharge  chamber  operation  becomes  vulnerable  to 
the  kind  of  misalignments  reported.  In  fact,  the  loss  of 
material  can  cause  higher  local  temperatures,  which  can  ac- 
celerate the  loss  of  material  in  a regenerative  process. 

(33,  34.  35,  36,  37) 

The  kinds  of  failures  that  can  occur  witnin  the  ce- 
sium ion  thruster  discharge  chamber  assembly  have  already 
been  noted  for  the  discharge  chamber  of  the  the  mercury 
unit  and  to  some  extent  for  other  components  of  this  unit. 
Early  development  tests  uncovered  a few  deficiencies  for 
v/hich  fixes  were  found  and  reported.  An  inability  to 
deflect  thrust  through  the  required  excursion  angle  was 
traced  to  an  initial  misalignment  in  the  accelerator 
electrode.  Later,  additional  anomalies  were  found  but 
were  not  fully  rectified  until  the  improved  accelerator  sus- 
pension was  adopted. 

A number  of  structural  members  and  joints  can  be  the 
source  of  failures  under  the  interaction  of  undetected  flaws 
in  material  and  fabrication  processes  thermal  cycling,  and 
erosive  effect  of  partical  bombardment.  The  discharge  chamber 
design  includes  a multiplicity  of  anode  members  that  must  be 
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mounted  and  maintained  at  a set  value  of  electric  potential. 
The  magnets  must  be  maintained  in  position.  The  beam  extruc  • 
tion  grids  must  be  mounted  in  precise  alignment  and  the 
alignment  retained  under  the  thermal  cycling  ot  start  ,p  and 
shutdown.  The  alignment  must  further  be  controlled  as  a 
means  of  thrust  vector  control,  which  involves  eight  electric 
heater  elements  with  compound  functions  of  structural  support 
and  position  control.  The  anode  feed  ring  must  be  supported 
in  position  to  feed  cesium  vapor,  a function  that  includes 
the  operation  of  an  electric  heater  and  connectors  tor 
electric  potential  setting.  The  shel]  of  the  discharge 
chamber  also  provides  a mounting  for  the  main  cathode. 


Co "iponent  Reliability  Model 

["I 

-At  - ( t-6000)^  j where  t = operating  time 

'a  J A = constant  failure  rate 

a = Weibull  scale  factor 
P = Weibull  shape  factor 


Failure  Rate  Uncertainty  Distribution  Model 


Log  Normal 

Coefficient  of  Variation 

■n  - 5.44 

Mean 

M = -12.82 

Standard  Deviation 

(j  — 1.85 

Failure  Rate  Mean  and  3ounds 

Lower  Bound  Median 

Mean  95% 

Upper  Bound 

\05  \ 5 

e|a| 

A.  95 

0.129  2.71 

15 

56.8 

x 10  per  hour 
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# 

Weibull  Parameter  Values  and  Bounds 
Shape  Parameter  P=  2.0 

Scale  Parameter  a,  Equivalent  Mean  and  Bounds 

5%  Lower  Bound  Equivalent  Mean  Median  95%  Upper  Bound 
a.  05  aE  a.  5 a.  95 

7.31  x 107  2.8  x 108  1.3  x 109  2.313  x 1010 
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NEUTRALIZER  ASSEMBLY 


The  neutralization  function  is  required  to  maintain  the 
overall  charge  neutrality  (current  neutralization)  of  the 
space  vehicle,  so  that  the  ion  beam  does  not  cause  any  image 
charge  on  the  vehicle  thereby  retarding  the  ions  and  reducing 
engine  thrust  (charge  neutralization) . The  neutralizer 
cathode  is  similar  in  function  to  the  main  cathode  and  was, 
in  fact,  first  developed  to  provide  a long-life  neutralizer. 
Except  for  the  reduced  mercury  flow,  the  form  of  the  neu- 
tralizer assembly,  including  isolator  and  vaporizer,  is  close 
to  the  main  CIV  assembly.  Since  there  is  no  evident  relation 
ship  of  flow  rate  to  the  probability  of  failure,  the  pre- 
viously developed  failure  data  are  considered  to  be  directly 
applicable.  Also,  the  incorporation  of  the  plasma  bridge 
emitter  into  the  hollow  cathode  has  enabled  placement  of  the 
neutralizer  device  some  distance  from  the  ion  beam,  thus 
inhibiting  tip  erosion. 


Neutralizer  Isolator  Reliability  Mode] 


where  t = operating  time 

P = shape  factor  = 2 
oi  = scale  factor  - 1.305  x 

See  Isolator  Model,  page  1-79  for  details 


R = exp 


a 


Neutralizer  Vaporizer  Reliability  Model 


R = exp  (-\t)  where  t = operating  time 

A = failure  rate  per  hour 

See  Vaporizer  Model,  page  1-81  for  details 


Neutralizer  Cathode  Reliability  Model 

R = exp  (-At)  ’here  t = operating  time 

A = failure  rate  per  hour 

See  Hollow  Cathode  Model,  page  1-78  for  details 

The  failure  rate  and  scale  factor  values  at  the  5%,  Median, 
Mean  and  95%  bounds  for  these  values  are  the  same  as  their 
CIV  counterparts. 

Neutralizer  Probe  Reliability  Model  (Cesium  Ion  Only) 

Use  Cathode  Model,  page  1-78. 


► 
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THRUST  VECTORING  ASSEMBLY  (TVA) 


The  current  prominent  approach  to  thrust  vector  control 
is  mechanical  gimbaling.  With  the  incorporation  of  dished 
grids  at  the  accelerator/screen  grid  assembly,  translation 
becomes  more  difficult  to  execute.  Additionally , the  gimbal 
mechanism  is  favored  over  an  all-electrostatic  device  on  the 
basis  of  longer  probable  useful  life.  A summary  parts  list 
includes  the  following: 

Lower  support  joint  - two  axes  of  rotation  with 
three  relative  motion  bearings,  including  space- 
craft mount 

Upper  support  joint  - one  rotary  bearing  combined 
with  slotted  longitudinal  strut 

Linear  actuator  (two  required)  - jack  screw  type 
with  geared  stepping  motor  drive,  engage  mount 
ring  from  spacecraft  support 

. Mount  ring  - provides  bearing  mounts  and  engages 
endplate  of  discharge  chamber. 

The  parts  of  this  assembly  have  fairly  well-established 
failure  histories  since  functionally  similar  mechanisms  have 
been  operated  on  many  aeronautical  applications  and  onboard 
spacecraft,  star  tracker  drives,  for  example.  Bearings  at 
me  gimbal  axes  may  weld  after  sustained  space  exposure.  If 
misalignments  occur  as  a consequence  of  launch  forces  or 
spacecraft  thermal  deformation,  driving  torques  may  exceed 
capacities  of  actuators,  gearing,  or  steppiny  motors.  The 
jackserews  are  inherently  high-friction  devices  which  can 
jam  or  score  the  screw  thread.  If  overloaded,  the  stepper 
motors  may  develop  hot  spots,  loss  of  insulation,  and  open 
circuits. 


TVA  Lower  Support 
Component-  Reliability  Model 

R = exp(-At)  where  t = operating  time 
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Failure  Rate  Uncertainty  Distribution  Model 


Log  Normal 

Coefficient  of  Variation 

V = 3.785 

Mean 

= -14.45 

Standard  Deviation 

a = 1.652 

Failure  Rate  Mean  and  Bounds 

5%  Lower  Bound  Median 

x.05  *.5 

0.035  0.53 


Mean  95%  Upper  Bound 
E j A j *.95 

2.07  8.03 

X 10  6 per  hour 
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TVA  - Motor  and  Bearing 


Component  Reliability  Model 

R = exp(-Xt)  where  t = operating  time 

Failure  Rate  Uncertainty  Distribution  Model 
Log  Normal 


Coefficient  of  Variation 
Mean 

Standard  Deviation 
Failure  Rate  Mean  and  Bounds 


5%  Lower  Bound  Median 

a.05  a.5 

0.188  1.87 

TVA  - Linear 


Componori t Reliability  Mode  1 
P - e.<p\-\t) 


V=  2.45 
M = -13.  19 
<T  = 1.  395 

Mean  95%  Upper  Bound 
E |x  | A.  95 

4.93  18.5 

X 10  6 per  hour 

Actuation 

where  t = operating  time 


Failure  Rate  Uncertainty  Pis tribution  Model 
Log  Normal 


Coefficient  of  Variation 

Ti  = 

2.49 

Moan 

n = 

-13.24 

Standard  Deviation 

a = 

1.405 
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Failure  Rate  Mean  and  Bounds 


5%  Lower  Bound 

Median 

Mean 

95%  Upper  Bound 

\ 05 

x.  5 

Ejxj 

*.95 

0.176 

1.  78 

4.76 

17.9 

X 10"6 

per  hour 

TVA  - Upper  Support 

Component  Reliability  Model 

R = exp(-Xt)  where  t = operating  time 


Failure  Rate  Uncertainty  Distribution  Model 
Log  Normal 

Coefficient  of  Variation  7J  = 4.629 

Mean  M - -15.05 

Standard  Deviation  a = 1.764 


Failure  Rate  Mean  and  Bounds 


5%  Lower  Bound 
*.05 
0.016 


Median 
*.  5 
0.291 


Mean 

eIM 

1.  38 

X 10  6 per  hour 


95%  Upper  Bound 


l.  9 5 


5.  3 
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SPARK  INITIATOR 


As  indicated  in  the  Electronic  Components  and  Assemblies 
section,  igniters  (arc-initiation  electrodes)  also  can  be 
described  by  the  combination  of  a (low)  constant  failure 
rate  contribution  and  a relatively  narrov:  wear-out-type 
distribution.  For  the  latter,  we  shall  use  a normal  distri- 
cr 

bution  with  = 0.2.  Both  contributions  are  regarded  as 
b N 

dependent  on  the  number  of  firing  pulses. 

Flight  and  laboratory  test  data  indicate  pn>36  x 106 

pulses  andX<2  per  billion  pulses.  These  will  be  used  as 

tJle  q5  anc^  *.95  estimates.*  The  coefficient  of 

variation  for  A must  be  larger  than  the  standard  electronic 
component  value;  we  shall  use  tj  = 2.5. 

The  normal  contribution  uncertainty  is  comparable  to 
those  for  the  colloid  thruster  system  neutralizer,  with 
V =■■  .304. 

In  this  case,  the  failure  processes  associated  with 
the  two  contributions  appear  to  be  distinct  and  uncorrelated. 
It  will  be  found  convenient  to  deal  with  the  two  contribu- 
tions at  the  system  level,  as  if  there  were  two  components 
in  series,  one  providing  the  normal  contribution  and  the 
other  providing  the  exponential  contribution. 


Component  Reliability  Model 


R - [exp  (-  At)] 


OO 


1 exp 


mt 


dt 


where  t = mission  time 


* ~ To  avoid  confusion  with  the  uncertainty  parameters  <7 
and  m 1 and  shall  hereafter  be  replaced  by  s and  m, 
respectively . 
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Note:  Second  component  of  model  is  a normal  distribution. 

It  is  commonly  tabulated  with  table  look-up  using 
K = t-m 
s 


Failure  Rate  Uncertainty  Distribution  Model 


Coefficient  of  Variation 

= 

2.5 

Mean 

M = 

-22.33 

Standard  Deviation 

CT  = 

1.407 

The  normal  contribution  uncertainty  is  comparable  to  that 
of  the  colloid  thruster  system  neutralizer,  with  V-  0.304. 

Failure  Rate  \ Mean  and  Bounds 


5% 

Lower  Bound 

Median 

Mean  95%  Upper  Bound 

0. 

000G2 

0.0002 

0.00053  0.002 

-6 

X10  per  pulse 

Normal  Contribution  Parameter  Values  and  Bounds 


5%  Lower  Bound 

Median  = Mean  95% 

Upper  Bound 

m „ 

m 

m 

.05 

. 5 

. 95 

36 

24 

12 

X10  6 per  pulse 
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ENERGY  STORAGE  CAPACITOR 


This  component  has  been  discussed  in  some  detail  in 
the  Electronic  Components  and  Assemblies  section  with  the 
conclusion  that  useful  reliability  estimates  will  require 
testing.  The  discussion  also  indicated  that  a combination 
exponential-normal  model  is  attractive: 


R(t)  = exp  (-At) 

r ■ i _ 

exp 

(t-p)2 

2 

•'t  a FT ?r 

V 

2° 

It  was  noted  that  heterogeneity  has  been  observed  in 
some  capacitor  populations;  the  model  omits  subpopulation 
effects,  although  these  should  be  considered  when 
sufficient  information  becomes  available. 

Because  these  capacitors  are  highly  specialized,  use 
of  MTL-HDBK-217B  data  for  estimation  involves  unusually 
large  uncertainties  that  should  be  reflected  in  larger- 
than-usual  coefficients  of  variation.  This  means  that 
test  results  will  outweigh  prior  information  as  to  the 
exponential  contribution  early  in  any  test  program. 

As  indicated  in  the  Electronic  Components  and 
Assemblies  section,  temperature  and  voltage  strongly 
influence  reliability.  Radiation,  effects  also  may  be 
important.  In  addition,  voltage  effects  differ  with 
capacitor  age,  and  radiation  effects  may  interact  with 
both  voltage  and  temperature  effects.  Temperature  is 
expected  to  affect  both  the  exponential  and  the  normal 
contributions.  Rate-dependent  radiation  effects  should  be 
expected  to  affect  the  exponential  contribution,  and  dose- 
related  effects  shoulo  be  expected  to  affect  primarily  the 
normal  contribution. 
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Component  Reliability  Model 

R = [exp  ( - A N)~|  J f _L 

L -1  1 sv'2* 


exp 


- (t-m) 

o 2 
2s 


2-| 


dt 


Note:  Second  component  of  model  is  a normal  distri- 

bution. It  is  commonly  tabulated  with  table 
look-up  using  K = t-m  . t = mission  time 

s 

For  this  capacitor  the  models  for  m,  s and  X are: 


- /M 
V\) 


1 ^ x IQ-*  cycles 


where  VQ  = rated  voltage 
K 


vA  = applied  voltage 
Convert  m to  time  using  /mission  life 


/ mission  lue  \ 

^ total  number  of  cycTesJ 


s = 0.  L65m 


'V 


X = 5 j xl0“12  per  cycle 


lV 


R 


Uncertainty  Distribution  Model 


Coefficient  of  Variation  V = 


,vc 

4.35 


m 

1.3 


Mean 


Standard  Deviation 


Pa rameter  Values  and  Bounds 

Lower  Bound  Median  Mean  95*  Upper  Bound 


A : 

c 

exp 

^-1.645(7 
1 : 

exp(y) 

exp 

r 2-1 

H + <7 
2 ‘ . 

exp 

m 

1 . 6 4 5 ct  J 

exp 

M-l . 645(7 

exp (M) 

exp 

exp 

1 . 6 4 5 cx  J 

♦•8. 7 
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MAIN  ELECTRODES* 


While  a build  up  of  charred  propellant  has  been 
observed  in  tests. (10),  no  performance  degradation  has  been 
noted.  The  performance  of  the  main  electrodes  are  much 
less  sensitive  to  wear  than  the  initiators.  Therefore,  the 
random  failure  constant  failure  rate  portion  of  the  initiator 
model  will  be  used  for  thp  main  electrodes. 


Component  Reliability  Model 

R = exp  (-AN)  where  N = number  of  pulses 

A = failure  rate  per  pulse 

Failure  Rate  Uncertainty  Distribution  Model 

Lognormal 

Coefficient  of  Variation  1)  = 0.29 
Mean  t1  =-22.33 


Standard  Deviation  c - 0.505 

Failure  Rate  Mean  and  Bounds 


5*  Lower  Bound 

Median 

Mean 

95%  Upper  Bound 

A 

.05 

X.5 

E(A) 

\ 95 

0.00002 

0. 0002 

0.0005 

0.002 

XlO-6  per 

pulse 

* 


Pulsed  Plasma 
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NEGATOR  SPRING 


This  component  was  assessed  as  having  a nearly  negligible 
failure  rate.  The  failures  are  considered  to  be  random;  the 
failure  rate  is  constant  throughout  the  mission.  Manufac- 
turing flaws  and  material  flaws  are  the  identified  failure 
mechanisms . 


Component  Reliability  Model 

R = exp  (-A  t)  where  t = mission  time 

A = failure  rate  per  hour 

Failui e Rate  Uncertainty  Distribution  Model 

Lognormal 


Coefficient  of  Variation 

T)  = 

3.77 

Mean 

n = 

-22.3 

Standard  Deviation 

a = 

1.2 

Failure  Rate  Mean  and  Bounds 


5%  Lower  Bound 

Median 

Mean 

95% 

Upper 

X.05 

\s 

E(A) 

A 

.95 

0.00005 

0.0004 

0.0008 

0.003 

XIO'6  per 

hour 
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PROPELLANT  BELLOWS  RESERVOIR  (Colloid) 


In  addition  to  containing  the  propellant  until  demanded 
by  the  thruster  the  bellows  has  a spring  force  that  pressurizes 
the  propellant  so  thac  it  can  flow  against  the  various  imped- 
ances of  the  system  (14). 

Development  problems  have  occurred  that  are  normal 
for  a new  system;  there  was  a structural  problem  that  in- 
volved the  upper  flange,  upper  dome,  and  convolution  weld 
joints.  The  flange  was  placed  in  torsion  when  the  bellows 
was  in  an  extended  position.  Design  changes  have  been 
recommended  that  would  eliminate  the  moments  that  caused 
the  torsion. 

Distortion  of  the  base  flange  of  the  bellows  during 
assembly  caused  its  coplanarity  to  go  out  of  . icification. 

This  distortion  is  a result  of  the  welding  of  the  inner 
bellows  and  bellow  convolution  to  the  base  flange (14). 

Aging  and  stress  relief  may  be  failure  mechanisms  that 
could  prevent  propellant  bellows  storage  system  from  supplying 
proper  pressure  required  to  operate  the  system.  A uniform 
tensile  force  is  required  to  compress  the  fluids  and  to  supply 
working  pressure. 

A leak  in  the  fill-valve,  bellows,  weld  joints,  or 
plumbing  that  leads  to  the  control  valve  would  be  catastrophic, 
as  the  bellows  is  constantly  supplying  pressure  to  the  fluid. 


Component  Reliability  Model 

R - exp  (-At)  where  t - pressurized  time 

A = failure  rate  per  hour 
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Failure  Rate  Uncertainty  Distribution  Model 


Log  Normal 

Coefficient  of  Variation 
Mean 

Standard  Deviation 
Failure  Rate  Mean  and  Bounds 

5%  Lower  Bound  Median 

x.95  *.5 

0.0009  0.049 


i)  = 0.984 
\x  = -16.84 
a = 0.823 


Mean 

95%  Upper  Bound 

E U | 

K 95 

0.068 

0.18,8 

10  6 per  hour 
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FILL  VALVE  (Colloid  Svstem) 


The  pressure  differential  across  the  colloid  system 
feed  valve  is  very  low  when  compared  to  the  differentials 
of  the  thermochemical  system.  The  TRW  Colloid  Interim  Final 
Report  #1  (Ref  14)  uses  a fill  valve  failure  rate  value  of 
0.073  x 10"6  per  hour  in  the  reliability  assessment.  This 
is  approximately  an  order  of  magnitude  lower  than  the 
expected  value  for  the  thermochemical  fill  valve  failure 
rate,  and  seems  reasonable  in  light  of  the  very  low  pressure 
differentials  in  the  colloid  system.  The  value  from  Ref  14 
will  be  used  as  the  expected  value  of  this  assessment. 

Since  that  report  did  not  address  failure  rate  uncertainties, 
the  thermochemical  system  fill  valve  uncertainty  model  will 
be  applied  herein. 


Component  Reliability  Model 


R = exp  (-At) 

Failure  Rate  Uncertainty  Distribution  Model 
Log  Normal 


where  t = mission  time 

X = failure  rate  per  hour 


Coefficient 

of  Variation 

7J  = 

10.5 

Mean 

M = 

-18. 79 

Standard  Deviation 

<7  = 

2.17 

Failure  Rate  Mean 

and  Bounds 

5%  Lower  Bound 

Median 

Mean 

95% 

Upper  Bound 

*.05 

\ 5 

e|a| 

*.95 

0.0002 

0.0069 

0.073 

0.246 

x 10  6 per  hour 
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PROPELLANT  FILTER* 


The  similar  function  resulted  in  the  use  of  the  thermo- 
chemical filter  model.  The  principal  difference  in  applica- 
tion is  the  absence  of  a significant  pressure  differential 
across  the  colloid  filter.  While  use  of  the  thermochemical 
filter  model  should  therefore  yield  conservative  results  in 
the  colloid  system,  its  use  is  recommended  until  endurance 
testing  or  flight  experience  indicates  the  appropriate  modi- 
fication. 


leaking  failure  rate 
t = mission  time 
t - operating  time 

(x  = Weibull  scale  factor 
0 = Weibull  shape  factor 

Failure  Rate  Uncertainty  Distribution  Model 

Log  Normal 

Coefficient  of  Variation  V - 1.J3 
Mean  M=  -18.35 

Standard  Deviation  <x=  1.667 


Failure  Rate  Mean  and  Bounds 


5%  Lower  Bound 

Median 

Mean 

95%  Upper  Bound 

x.05 

\ 5 

Ejx\ 

\ 95 

0.00067 

0.0107 

0.043 

0.166 

-6 

x 10  0 

per  hour 

Component  Reliability  Model 


* 

Colloid  System 
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Weibull  Parameter  Values  and  Bounds 


Shape  Parameter 
Scale  Parameter 
5%  Lower  Bound 
a . 05 

1.9  x 107 


0 = 1.5 

a Equivalent  Mean  and  Bounds 
Mean  Median  95%  Upper  Bound 
«E  “5  a . 95 

7.35  x 107  2.95  x 108  4.5  x 109 


Partition  by  Failure  Modes 
1.  Leakage 

1 . 1 Model 

R = exp  (-XLt) 


1.2  Failure 

Rate  Mean 

and  Bounds 

5% 

Lower  Bound 

Median 

Mean 

95%  Upper  Bound 

A.05 

A.  5 

E|g 

A.  95 

0.00067 

0.0107 

0.043 

0.166 

2. 

Clogging 

X 10"6 

per  hour 

2 . 1 Mode 1 

R = 

exp  - t 

L 

2.2  Weibull 

Parameter 

Values  and 

Bounds 

Weibull 

Shape  Parameter  0=1. 

5 

Weibull 

Scale  Parameter  a 

5% 

Lower  Bound 

Mean 

Median 

95%  Upper  Bound 

a.05 

“5 

«95 

1.9  x 107 

7.  35  x 10 

7 2.95  x 108  4.3  x 109 
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CONTROL  BELLOWS  (COLLOID) 


The  control  bellows  serves  two  purposes:  initially, 

it  assists  in  opening  and  closing  the  ball  valve;  in  addi- 
tion, it  creates  extra  contraction  that  pulls  back  the  pro- 
pellant from  needle  tips  and  also  allows  for  a small  amount 
of  leakage  past  the  ball  valve.  Pullback  is  classified  as 
a major  goal  of  program;  there  are  further  hardware  modifi- 
cations that  will  result  in  increased  reliability  and  that 
will  also  improve  the  startup  procedure.  The  same  relia- 
bility and  uncertainty  models  and  values  are  proposed  as 
were  used  for  the  propellant  storage  bellows. 


Component  Reliability  Model 
R = exp  (-Xt) 


where  t = operating  time 

X = failure  rate  per  hour 


Fa i Mire  Rate  Uncertainty  Distribution  Model 
Lognormal 

Coefficient  of  Variation  17  = 0.985 

Mean 

Standard  Deviation 


M = -16 . 84 
a = 0.8236 


Failure  Rate  Mean  and  Bounds 


5%  Lower  Bound 

Median 

Mean 

95% 

Upper  Bound 

in 

o 

\5 

E{x( 

X.95 

0.0125 

0.0465 

0.068 

0.188 

X10"6  per 

hour 
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BALL  VALVE  (COLLOID  SYSTEM) 


The  tungsten  ball  valve  operates  on  a pressure  differ- 
ential basis  similar  to  a one-way  check  valve.  The  valve 
is  susceptible  to  leakage  as  a result  of  objects  being  trap- 
ped in  the  valve  seat.  The  supply  pressure,  a result  of 
the  tension  established  by  the  bellows  acting  to  close  the 
valve,  is  about  3.5  in.  of  mercury  (14) . Failure  mecnanisms 
would  be  corrosion  or  contamination  in  the  propellant  storage 
system  rather  than  any  stuctural  failure. 


Component  Reliability  Model 

R = exp  (-At)  where  t = mission  time 

A = failure  rate  per  hour 

Failure  Rate  Uncertainty  Distribution  Model 

Lognormal 

Coefficient  of  Variation  rj  = 13.08 

Mean  M = -17.31 

Standard  Deviation  <r  = 2.27 


Failure  Rate  Mean  and  Bounds 

5%  Lower  Bound  Median  Mean  95%  Upper  Bound 


A 


.05 


E)Xj 


A 

.95 


0.0007 


0.03 


0.4  1.27 

X10  6 per  hour 
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2.  Fail  Closed 
2.1  Model 


R = exp 

{- 

where 

t = mission  time 

\ = fail  closed  rate 
c 

2.2 

Failure 

Rate 

eLc)  “ 

50%  E |X } 

2.3 

Failure 

Rate  Mean 

and  Bounds 

5%  Lower  Bound 

Median 

Mean 

95%  Upper  Bound 

x.05 

x.  5 

E |X( 

x.  95 

0.002 

0.0108 

0.20 

0.575 

xio"6 

per  hour 
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ZEOLITE  CANNISTER 


When  heated,  zeolite  releases  CO2,  which  increases  the 
pressure,  expands  the  control  bellows)  and  actuates  the 
tungsten  ball  valve.  Allowing  the  zeolite  to  cool  absorbs 
much  of  the  C0„  and  reduces  the  internal  pressure  within  the 
bellows.  The  power  to  the  heater  located  in  the  zeolite 
cannister  is  regulated  by  comparing  the  exhaust  beam  current 
to  a reference  current (14).  Reliability  of  system  propellant 
delivery  is  based  upon  operation  of  the  regulator  mechanism 
and  the  heater.  Failure  of  either  mechanism  would  result  in 
failure  of  the  propulsion  system  in  either  the  on  or  off 
position.  Since  the  heater  is  assessed  separately,  the 
principal  failure  mode  for  the  cannister  is  leaking. 


Component  Reliability  Model 


R = exp  (-\t)  where  t.  = operating  hours 

A = failure  rate  per  hour 

Failure  Rate  Uncertainty  Distribution  Model 

Log  Normal 

Coefficient  of  Variation  rj  = 2.016 
Mean  M = -17.68 

Standard  Deviation  o * 1.27 


Failure  Rate  Mean  and  Bounds 

5%  Lower  Bound  Median  Mean 


95%  Upper  Bound 


\ 


.05 


0.0026 


\s 

EW 

in 

<r» 

0.0209 

0.047 

0.169 

-6 

X 10  per  hour 
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SYSTEM  PROPELLANT  MANIFOLD* 

The  propellant  feed  line  model,  failure  rate  and 
uncertainty  distribution  were  used  to  model  the  colloid 
propellant  manifold. 

Component  Reliability  Model 

R = exp  (-At)  where  t = operating  time 

A = failure  rate  per  hour 

Failure  Rate  Uncertainty  Distribution  Model 


Lognormal 

Coefficient  of  Variation 

n = 

0.643 

Mean 

-16.39 

Standard  Deviation 

cr= 

0.588 

Failure  Rate  Mean  and  Bounds 


5%  Lower  Bound 

Median 

Mean 

95%  Upper  Bound 

X.05 

X.  5 

E iM 

\ 95 

0.029 

0.076 

0.09 

0.02 

X.10"6  per 

hour 

* 

Colloid  System 
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ELECTROFLUIDIC  ISOLATION  VALVE 


This  component  is  yet  to  Le  developed.  Its  need,  how- 
ever, to  minimize  system  damage  upon  thruster  module  failure, 
is  evident.  It  would  be  premature  at  this  time  to  assess  in 
detail  failure  modes  and  rates.  In  order  to  allow  system 
modeling,  a model  for  this  component  was  synthesized  by 
joining  the  electric  isolator  model  and  the  propellant  iso- 
lation valve  model  from  the  thermochemical  section. 


Component  Reliability  Model 

R = exp  [-  A n- A t-t  @1 
c m op  j 

a 


where 


A 

= 

cycle  fail  rate 

I5C 

number  of  cycles 

\n 

= 

mission  time  fail 

rate 

t 

= 

mission  time 

top 

= 

operating  time 

0! 

s 

Weibull  scale  factor 

0 

= 

Weibull  shape  factor 

railure  Rate  Uncertainty  Distribution  Model 


Log  normal 

Coefficient  of  Variation 

V 

xc 

= 0.5155 

Xf 

0.5165 

Mean 

M 

= -17.17 

-17.26 

Standard  Deviation 

a 

= 0.4855 

0.4863 

Failure  Rate  Mean  and  Bounds 

5%  Lower  Bound  Median 

Mean 

95%  Upper 

Bound 

\<35  \ 5 

EIM 

\ 95 

^c 

Xm 

0.016  0.035 

0.01*  0.032 

0.32 

0.29 

1.11 

1.01 

per 

per 

cycle 

hour 

X 10 

-6 
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Weibull  Model  Parameter  Values  and  Bounds 


Shape  Factor  0=2 
Scale  Factor  a 

5%  Lower  Bound  Equivalent  Mean  Median 
at  nc  " E ".  5 


.05 

3.374  x 10 


8 


1.305  x 10y  4.89  x 10' 


95%  Upper  Bound 
".95 

7.198  x 1010 


Partition  by  Failure  Modes 
1 . Electric  Isolation  Failure 

1 . 1 Model  t 0 

R = exp  [ 2E  ] 

1.2  Model  Parameter  Values  and  Bounds 
Weibull  Shape  Factor  0=2 
Weibull  Scale  Factor  a 

5%  Lower  Bound  Equivalent  Mean  Median 
".05  "E  ".5 

3.374  x 108  1.305  x 109  4.89  x 109 


95%  Upper  Bound 
"95 

7.198  x 1010 


Fluidic  Isolation  Failure 


m 


2.1  Model 


R = exp  [-Xmt  “ *CN] 


2.2  Failure  Rate  Mean  and  Bounds 
5%  Lower  Bound  Median  Mean 


.05 

0.014 

0.016 


. 5 

0.032 

0.035 


E\\\ 

0.29 

0.32 


95%  Upper  Bound 
*.95 

1.01  per  hour 
1.11  per  cycle 


1-117 


THRUSTER  FRAME 


* 


The  thruster  frame  assembly  includes  the  module  frames, 
two  temperature  transducers  and  a heater.  The  reliability 
assessment  of  Ref.  14  assigns  a value  of  0.0447  per  million 
operating  hours.  Previous  assessment  of  a line,  tank  or 
valve  heater  indicate  that  this  is  a reasonable  failure  rate 
for  the  heater  alone.  The  inclusion  of  the  other  components 
and  the  location  of  the  frame  relative  to  the  extractor 
insulators,  indicate  that  the  failure  rate  assigned  by  Ref. 
14  can  best  be  used  as  a guide  to  the  5%  Line  Bound  on  the 
failure  rate. 


Component  Reliability  Model 
R = exp  (-At) 


where  t = mission  time 

A = failure  rate  per  hour 


Failure  Rate  Uncertainty  Distribution  Model 


Lognormal 

Coefficient  of  Variation 

rj:z 

3.64 

Mean 

V = 

-14.25 

.Standard  Deviation 

a = 

1.63 

Failure  Rate  Mean  and  Bounds 

5%  Lower  Bound  Median 

A A 

.05  .5 

0.0445  0.65 

X. 


Mean  95%  Upper  Bound 

\g5 

5 9.47 

per  hour 


* 

Colloid  Thruster  System 
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THRUSTER  MODULE 


* 


Data  collection  for  the  colloid  system  reveals  that 
the  largest  uncertainty  of  the  system  concerns  the  failure 
rates  that  have  been  assumed  for  the  needle  assemblies. 

The  failure  rates  available  for  the  needle/extractor 
assembly  are  arbitrary  because  of  lack  of  historical  data(14). 
Degrading  effects  revealed  during  a 4350-hour  test  program 
in  which  there  was  no  evidence  of  approaching  failure  are 
discussed  below. 

Needle  uniformity  of  construction  is  necessary  to 
maintain  high  beam  efficiencies.  Early  tests  indicated 
that  lack  of  quality  control  in  fabrication  was  responsible 
for  geometry  variations  and  low  efficiencies.  Variations 
in  rim  geometry  and  needle  depth  contributed  to  wide 
variations  in  charge  and  velocity  of  the  ejected  droplets. 

Contamination  is  possible  if  there  is  a lack  of  care  in 
preparing  the  feed  system  and  in  establishing  proper 
loading  techniques.  Oil-like  contamination  film  on  the 
needles  prevents  a complete  wetting  of  the  emitter  source 
and  a variation  in  the  electrostatic  field  (non-uniform 
thrusting} . 

Three  performance-degrading  phenomena  were  noted 
(during  the  ground  life  test)  that  supposedly  will  be 
reduced  in  effect  during  operation  in  space  and  when 
suggested  design  changes  are  incorporated:  (1)  needle  tar 

buildup,  (2)  material  buildup  on  the  shield,  and  (3)  needle 
erosion . 

The  following  assessment  is  based  on  a specific 
design  and  reflects  failure  rate  estimates  (Ref,  14) 
that  seem  nearer  to  a lower  bound  than  to  E|A|.  To 
facilitate  analysis  of  other  configurations,  the  estimates 
are  for  a submodule  that  consists  of  36  needles,,  shield 
electrodes,  and  needle  seals;  three  extractor  insulators; 
and  one  plenum,  with Ag  g,.  = 0.031  x 10“6. 


* 

Colloid  Thruster 
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Failure  rate  uncertainty  distribution.  The  uncertainty 
is  comparable  to  that  associated  with  the  mercury  ion  engine 
main  isolator: 


^1=  13.08 
a = 2.645 

(T  — 1.626. 

Constant  failure  rates  are  used  despite  possible 
redundancies  that  apply  if  degraded  performance  is  allowable; 
redundancy  can  be  imputed  to  submodule  combinations  when 
component/system  relationships  are  examined. 


Component  Reliability  Model 

R = exp  (-  At)  where  t = mission  time 

A = failure  rate  per  hour 

Failure  Rate  Uncertainty  Distribution  Model 

Lognormal 

Coefficient  of  Variation  V * 3.616 

Mean  (*-  -15.29 

Standard  Deviation  a=  1.62 


Failure  Rate  Mean  and  Bounds 


5%  Lower  Bound 

Median 

Mean 

95%  Upper  Bound 

X.05 

A.5 

e|a| 

A.95 

0.031 

0.45 

1.69 

6.53 

> 

XIO"6  per 

hour 
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FILAMENT  NEUTRALIZER 


The  purpose  of  the  neutralizer  is  to  provide  a 
sufficient  quantity  of  electrons  (by  means  of  a heated 
tungsten  wire)  to  equal  the  positive  current  from  the 
thruster  (14).  Included  with  the  filament  is  a positive  po- 
tential monitor,  which  is  used  to  collect  excess  electrons  from 
the  neutralized  exhaust  plasma.  Two  are  used  per  system  (one 
redundant) . Failure  of  the  neutralizer  would  prevent 
formation  of  a neutral  plasma  (at  50v)  that  extends  through- 
out the  beam  and  merges  with  space  potential. 

Three  possible  failure  modes  are  identified  that  can 
influence  tne  reliability  of  the  colloid  neutralizer: 

(1)  burnout  of  the  filament  (filament  evaporation), 

(2)  filament  wire  cyclic  fatigue,  and  (3)  mounting  spring 
preload  or  variation  of  the  spring  constant  (14).  Filament 
burnout  is  based  upon  a normal  wear-out  distribution, 
whereas  the  other  failure  modes  are  time  and  cyclic 
sensitive . 

The  primary  failure  mode  of  the  neutralizer  is 
filament  evaporation.  An  accelerated  life  test  was  conducted 
by  operating  the  filament  at  higher  temperatures  than 
normal  ones  seen  during  operation.  Initial  analyses  had 
correlated  failure  with  6 percent  change  in  filament 
diameter.  However,  the  accelerated  life  tests  indicated 
that  complete  burnout  occurred  after  a 12  percent  reauction 
in  filament  diameter.  The  life  expectancy  is  based  at 
24,000  hr.  when  8.5  percent  reduction  in  diameter  has 
occurred.  Operation  beyond  8.5  percent  reduction  will 
result  in  nonuniform  electron  emission,  which  would  require 
a higher  injection  potential  and  >uld  promote  further 
burnout. 

Component  Reliability  Model 


where  t = mission  time 
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Note:  The  second  and  third  components  of  the  model 

are  normal  distributions  for  filament  burnout  and  on-off 
cycling  respectively.  The  normal  distribution  is  commonly 


tabulated  with  table  look  up  using 


t - 


% 


and  K, 


t 


definitions  of  t.  m,  s. 


m 


c 


s 


c 


Failure  Rate,  \ , Uncertainty  Distribution  Model 


Coefficient  of  Variation  *1  = 

3.804 

Mean 

M ' " 

14.78 

Standard  Deviation 

a s 

1.655 

Failure  Rate  Mean  and  Bounds 

5%  Lower  Bound  Median 

Mean 

95%  Upper 

Bound 

A. 05  A. 5 

B{\( 

A.  95 

0.024  0.38 

1.5 

5.8 

X10“6 

per  hour 

Burnout  Normal  Contribution 

Parameter 

, m^,  Values 

and  Bounds 

5%  Lower  Bound  Mean  = 

Median 

95%  Upper 

Bound 

mb.  05  mb.05  mb.95 

10,000  20,000  30,000 

Sb  » 3 Mb 


Cyclic  Normal  Contribution  Parameter, 


5%  Lower  Bound  Mean  = Median 


9,250  18,500 


m , Values  and  Bounds 
c 

95%  Upper  Bound 

mc . 95 
27,750 
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Conversions 


1.  m already  in  terms  of  time  conversion  not  required. 

2.  Convert  mc  to  time  base  using  /total  mission  hours 

' \total  number  of  cycles 


as  the  conversion  factor. 
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PRESSURIZED  TANK 


The  failure  modes  for  this  component  are  rupture  and 
leakane.  Most  imperfections  will  be  minute,  leading  to 
leak  failure  rather  than  rupture  (a  distribution  of  80% 
leak  failure  and  20%  rupture  failure  is  indicated) . Typi- 
cal failure  locations  include  diaphragm  (or  bladder)  and 
tank  interface,  valve  and  tank  interface,  and  welded 
joints.  The  principal  failure  mechanisms  include  handling 
and  workmanship  and  corrosion.  Metal  fatigue  has  also  been 
suggested  as  a possible  mechanism  of  lower  importance. 


Component  Re liablity  Model 


R = exp (-At)  where  t = pressurized  time 

A = failure  rate 


Failure  Rate  Uncertainty  Distribution 
Log  Normal 


Coefficient  of  Variation 

V = 2.5 

Mean 

»*  = -16.27 

Standard  Deviation 

1.4075 

Failure  Rate  Mean  and  Bounds 

5%  Lower  Bound  Median 

Mean 

95%  Upper  Bound 

\ 05  \ 5 

EtM 

\ 95 

.0085  0.086 

.231 

.87 

Xl0~6per  hour 
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Partition  by  Tank  Halves  (to  accommodate  tank/bladder  systems) 
1.  Propellant  Half  Failure 

1.1  Model  R = exp(-Xt) 

1.2  Failure  Rate 


E{Xprop}  = 50*  Ejx} 

1.3  Failure  Rate  Mean  and 

5%  Lower  Bound  Median 

x.05  X.5 

0.0022  0.032 

2,  Pressurant  Half  Failure 

2.1  See  l.l 

2.2  See  1.2 

2.3  See  1.3 


Bounds 


Mean 

95%  Upper  Bound 

E)\f 

tn 

• 

✓< 

0.116 

0.452 

X10~6  per  hour 
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BLADDER/DIAPHRAGM 


The  function  of  these  devices  is  to  provide  for  ex- 
pulsion of  the  propellants  while  simultaneously  prevent- 
ing the  pressurant  gases  from  flowing  further  downstream 
in  the  system.  A well  defined  choice  of  materials  for 
these  components  must  be  made  on  the  basis  of  the  design 
operating  life  of  the  system.  Elastomerics  (such  as  EPT 
and  the  AFE  series)  can  be  considered  for  life  times  of 
about  7 years  with  hydrazine  fuels  and  about  3 years  with 
oxidizers.  For  longer  periods  of  time  metallic  devices 
must  be  considered,  primarily  because  of  swelling  and  per- 
meation of  elastomerics  when  in  contact  with  propellants 
such  as  nitrogen  tetroxide. 

Failure  modes  for  these  expulsion  devices  are  pri- 
marily leakage  and  rupture,  which  are  caused  by  (1)  im- 
perfections in  the  materials  and  fabrication  processes 
and  (2)  folding  tears  (elastomeric)  and  fracture  (me- 
tallic) and  (3)  pinholing.  Corrosion  of  the  metallic 
moving  parts  and  metal  to  metal  seals  during  long  missions 
is  another  failure  mechanism. 


Component  Reliability  Model,  Elastomerics 

Elastomerics  bladders  and  diaphragms  were  assessed 
as  having  a 5-7  year  life  time  with  hydrazine  fuels  and 
a 3 year  life  time  with  oxidizers.  The  life  limiting 
mechanisms  are  swelling  and  permeation  after  prolonged 
contact  with  the  propellants.  In  order  to  model  this 
behavior  the  following  composite  model  was  selected: 


Fuel 

Oxidizer 

R = exp(-Xt) 

for 

0§t£2.5  yrs 

0£t£l.5  yrs 

for 

2.5  yrsSt 

1.5  yrs£t 

6: 

2.2  x 104hrs 

1.3  x 104  hrs 
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where  X = random  time  dependent  failure 
rate 

t = mission  time 

a = Weibull  model  scale  factor 

0 = Weibull  model  shape  factor 

<5  = delay  factor. 


1.  Fuel  (Hydrazine)  application:  Data  was  available 

to  determine  a failure  rate  (x)  and  uncertainty  distri- 
bution for  the  random  failure  component.  The  Weibull 
component  parameters  (a,/3)  were  calculated  to  reflect 
the  reported  upper  limits  (5  to  7 years)  for  elastomeric 
hydrazine  compatibility. 

2.  Oxidize  application:  The  same  random  failure  rate 

and  uncertainty  distribution  was  used  as  identified  for 
fuels  application.  The  Weibull  model  component  param- 
eters were  calculated  to  reflect  the  reported  life  limit 
(3  years)  for  use  of  elastomerics  with  oxidizer  (N20^) . 


Failure  Rate  Uncertainty  Distribution  Elastomerics 


Log  Normal 

Coefficient  of  Variation 

T}  * 

.75 

Mean 

P * 

- 14.56 

Standard  Deviation 

<7  * 

.688 

Failure 

Rate  Mean  and 

Bounds , 

Elastomerics 

5% 

Lower  Bound 

Median 

Mean 

95%  Upper  Bound 

x.05 

\ 5 

E)Al 

x.95 

.15 

.48 

.6 

1.48 

X 10. ’6  per  hour 
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Weibull  Scale  Factor  Mean  and  Bounds , Elastomerics 


5%  Lower 
Bound 

Mean 

Median 

95%  Upper 
Bound 

“.05 

“e 

“.5 

“.95 

Hydrazine 

c 

C 

C 

C 

Application 

5 x lO3 

1.233  x 

106 

1.54  x 10° 

4.93  x 10° 

Oxidizer  (N2O4) 

3.7  x 108 

00 

0 

Q 

Q 

Application 

9.085  x 

1.135  x 0 

3.63  x 10s 

Wpjhnll  Shane  Factor,  / 3 and  Delay  Factor  6,  Elastomerics 

0 a 

Hydrazine 

Application  1.2 

Oxidizer  (N2O4)  ^ 

Application  2 1.3  x 104  hrs 


2.2  x 104  hrs 


Component  Reliability  Model,  Metallics 


R = exp  (-At) 


for  0$t£5  year 


R = exp 


a J 
where 


for 

6 = 
A = 


t = 


a 

P 

6 


5£t510  + year 

4.3  x 104  hrs 
random  time  dependent 
failure  rate 
mission  time 

Weibull  model  scale  factor 
Weibull  model  shape  factor 
delay  factor. 


Failure  Rate  Uncertainty  Distribution 
Log  Normal 

Coefficient  of  Variation  >)  = 4.18 
Mean  M = -17 .38 

Standard  Deviation  cr  = 1.7083 
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Failure  Rate  Mean  and  Bounds , Metallic 


5%  Lower 
Bound 

Median 

Mean 

95%  Upp' 
Bound 

x.05 

\5 

e|\} 

\ 95 

.0017 

0.028 

.122 

.471 

X 10"b  per 

hour 

Weibuli  Scale  Factor  Mean  and  Bounds 


5%  Lower 

95%  Upper 

Bound 

Median 

Mean  Bound 

".05 

“.5 

a a 

E . 95 

.42  x 106 

4.079  x 107 

9.36  x 106  6.72  x 10 

Weibull  Shape  Factor,  0=  1.2 
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PROPELLANT  FEED  LINES 


While  the  feed  line  environments  and  propellants  are 
quite  different  for  the  two  propulsion  system  classes, 
certain  similarities  override  from  the  reliability  point  of 
view.  Failure  modes  of  leakage  and  rupture  ate  common 
to  both.  Manufacturing  process  such  as  welding  and  swaging 
are  also  common  potential  sources  of  damage.  Further,  the 
available  reliability  data  for  each  group  overlap  in 
comparison.  Therefore,  a single  reliability  and  uncertainty 
model  set  will  be  formulated. 


Component  Reliability  Model 

R = exp  (-At)  where  t = operating  time 

A = failure  rate 


Fai lure  Rate  Uncertainty  Distribution 
Log  normal 


Coefficient  of  variation 

V = 

.42 

Mean 

P = 

-16.4 

Standard  Deviation 

a = 

.592 

Failure  Rate  Mean  and  Bounds 

5%  Lower  Bound  Median 

Mean 

95%  Upper  Bound 

A \ 

.05  A . 5 

eIM 

\95 

0.0235  .076 

0.09 

0.2 

X10-6  per  hour 
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FILL  VALVE 


This  component  is  used  to  introduce  the  pressurant  or 
propellant  into  its  storage  tank.  Upon  completion  of  fluid 
loading  the  valve  is  closed  and  if  launch  occurs  on  schedule 
it  remains  in  this  position  throughout  the  remainder  of  the 
mission.  Failure  modes  of  this  component  are  rupture  and 
internal  leakage  of  the  valve  seat.  Rupture  can  be  caused 
by  flaws  appearing  randomly  in  the  material  and  by  stresses 
during  launch.  Redundancy  for  this  component  is  achieved 
by  capping  with  valve  closure  caps: 


Component  Reliability  Model 


R = exp(-Xt)  where  t = pressurized  time 

X - failure  rate 


Failure  Rate  Uncertainty  Distribution 
Lognormal 

Coefficient  of  Variation  V = 10.5 

Mean  M = -16.21 

Standard  Deviation  <7  = 2.1703 


Valves  in  general  are  exposed  to  repeated  cyclic  oper- 
ation and  their  reliability  models  reflect  the  situation 
with  cyclic  dependent  functions  that  can  often  drive  the 
overall  expression.  Fill  valves  however,  can  be  expected 
to  be  cycled  only  a few  times  in  system  pressure  tests  and 
finally  once  more  upon  charging  the  propellant  storage  tank 
prior  to  launch.  It  will  then  become  a passive  component 
of  the  system;  expected  to  last  the  mission  in  the  finally 
closed  condition.  Therefore  its  reliability  model  includes 
a time  dependent  function  only.  The  deleterious  effects 
of  test  cycling  prior  to  final  charging  are  included  in  the 


developed  failure  rate  to  be  applied  throughout  the  mission. 


Failure  Rate  Mean 

and  Bounds 

5%  Lower  Bound 

Median 

Mean 

95%  Upper  Bound 

A.05 

\ 5 

E|X| 

A.  95 

.003 

0.091 

.09 

.323 

X10  6 per  hour 
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REGULATOR 


The  function  of  the  regulator  is  to  maintain  a set 
pressure  of  pressurant  gas  delivered  to  the  propellant 
tanks.  This  component  would  not  be  required  in  a blow- 
down system.  Its  failure  modes  include  (1)  leakage  to 
space  due  to  case  failure,  (2)  fail  open  and  fail  closed 
due  to  erosion  of  the  seat,  (3)  contamination,  and  (4) 
corrosion.  Contamination  can  cause  deformation  of  valve 
seals  and  added  friction  between  moving  parts,  resulting 
in  reduced  ability  tc  open  and  close. 


Component  Reliability  Model 

R = exp  [-*d<t-«-op>  - Aoptop  - acn] 

Where  ~ failure  rate  for  non-firing 

mission  phases 

t = total  mission  time 

tQp  = operating  time 


Aop  = failure  rate  for  firing  mission 
v phases 


Ac  = failure  rate  per  cycle 

x = total  cycles 


Failure  Rate  Uncertainty  Distributions 
Lognormal  A 3 

Coefficient  of  variation,  17  1.48 

Mean  \x  -12.77 

Standard  Deviation  tr  1.0765 


^op  ^c 

2.09  1.35 

-7.41  -12.09 

1.2065  1.0188 
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Failure  Rate  Mean  and 

Bounds 

5% 

Lower  Bound 

Median 

Mean  95% 

Upper  Bound 

\ 05 

is 

{e}a 

A.  95 

Ad 

.48 

2.86 

5.1 

16.5 

X°P 

71.7 

605 

1402 

5106 

Ac 

.048 

5.6 

9.42 

30.0 

X10~6  per 

hour  (cycle) 

Partition 

i by  Failure 

Modes 

1.  Fail 

Low 

1.]  Model  R = exp 

['  Ad£dl 

Aopfop  A 

4 

1.2  Failure  Rates 

E jXdi j = 40% jE  Ad  } 
E |Aoplf  = 40%  {E  Xop[ 
E Iac1  \ = 40%  Ie  Xc  } 


1.3  Failure  Rate  Mean  and  Bounds 


5% 

Lower  Dound 

Median 

Mean 

95%  Upper  Bound 

X.05 

A.  5 

|e}a 

A.  95 

Adl 

0.197 

1.14 

2.04 

6.6 

Aopl 

28.5 

242 

5.61 

2054 

Acl 

0.418 

2.24 

3.77 

12 

xio'6 

per  hour  (cycle) 
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2. 


Fail  High  or  Oscillatory 

2.1  Model  * ■ «*{-\1fd-A01*0p  -»,*} 

2.2  Failure  Rates 
E{Aah } ■ 608  «{*<■.} 

E{  X°Ph}  ■ 60%  e/'  ; 

' < r ) 

E{'ch}  - 60%  e{  xc } 

2.3  Failure  Rate  Mean  and  Bounds 

5%  Lower  Bound  Median  Mean  95%  Upper  Bound 
A.°5  \ 5 E<*>  \95 


Adh 

0.295 

1.71 

3.06 

9.9 

Xoph 

43 

363 

841 

3064 

Xch 

0.63 

3.36 

5.65 

18 

X10  6 per  hour  (cycle) 
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CHECK  VALVE 


The  function  of  the  check  valve  is  to  control  the 
direction  of  flow  through  the  system  and  to  isolate  the 
thruster  from  interconnecting  systems.  The  failure  modes 
are  leakage/  fail  open,  and  fail  closed.  The  failure 
mechanisms  are  metal-to-metal  valve  seat  fretting  for  hard 
seat  valves,  polymer  seat  material  flow  under  load  or  high 
temperature,  binding  and  seizing  of  closure  guide  elements 
due  to  contamination,  and  fatigue. 


Component  Reliability  Model 

R = exp  [-  X CN  - Amt] 

where  X = cycle  failure  rate 
c 

N = number  of  cycles 
Am  = failure  rate  per  hour 

t = mission  time 

Failure  Rate  Unce riai.nty  Distribution  Model 


Log  normal 

*t 

^ c 

Coefficient  of  Variation 

1?  =* 

1.91 

11.9 

Mean 

M “ 

-13.4 

-10.05 

Standard  Deviation 

(7  = 

1.2402 

2.2273 
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Failure  Rate  Mean  and  Bounds 


5%  Lower  Bound 

Median 

Mean 

95%  Upper  Bound 

in 

o 

. 

X.5 

E{X} 

\ 95 

xc 

.68 

26.4 

315 

1029 

xt 

.197 

1.52 

3.28 

11.7 

Partition  by  Failure  Mode 

1. 

Fail  Open 

1.1  Model:  R = exp  (-X  N- 

c 

•Xft) 

1.2  Failure  Rates 

E|»col  * 25% 

!e  *cl 

£|*fol  « 25% 

lE  x,i 

1.3  Failure  Rate 

Mean  and 

Bounds 

5%  Lower  Bound 

Median 

Mean 

95%  Upper  Bound 

\ 05 

\ 5 

e|x| 

X.95 

Xc 

0.169 

6.59 

78.8 

257 

0.0493 

0.38 

0.82 

2.93 

XIO”6  per  hour  (cycle) 


2.  Fail  Closed 

2.1  See  1.1 

2.2  See  1.2 

2.3  See  1.3 
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3.  Fail  Partial 

3.1  Model:  R = exp  (-A^N-X^  t) 

3.1  Failure  Rates 

Ei*0p|  ' 504  E)Xci 

EjXfpj  = 45%  EjAfj 

3.2  Failure  Rate  Mean  and  Bounds 


5%  Lower  Bound 

Median 

Mean 

95% 

Upper  Bound 

\05 

\ 5 

m 

*.95 

Ac 

0.338 

13.2 

158 

515 

Af 

0.042 

0.486 

1.476 

5.64 

X10”6  per 

hour 

(cycle) 

4. 

Leak  to  space 

4.1  Model:  R = 

exp  UfL 

)t 

4.2  Failure  Rate 

E!Ani  ' 54 

E)Xf| 

4.3  Failure  Rate 

Mean  end 

Bounds 

5%  Lower  Bound 

Median 

Mean 

95% 

Upper  Bound 

\ 05 

\ 5 

E{X) 

\ 95 

Af  L 

0.00064 

0.019 

.164 

0.58 

XlO’6  per 

hour 
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ISOLATION  VALVE 


This  component  used  to  isolate  portions  of  a fluid 
system  (such  as  pressurant  gas  from  propellant  tanks  or 
stored  propellant  from  downstream  components) . Solenoid 
valves  are  most  commonly  used  in  this  capacity  although 
explosive  actuated  valves  find  use  in  systems  where  no 
pressurant  leakage  is  desired  for  long  durations.  Failure 
mode  for  the  explosively  activated  valve  include  failure  of 
the  electrical  leads,  failure  of  the  initiator,  failure  of 
the  explosive  and  rupture  of  the  housing  under  explosive 
pressure.  Failure  modes  for  the  reusable  solenoid  configu- 
rations include  fail  open,  fail  closed,  internal  leakage 
and  leak  to  space.  Fail  open/Fail  closed  mechanism  include 
electrical  failure,  seizure  of  the  armature  in  the  coil 
housing,  contamination  or  f setting  between  moving  parts. 
Internal  leakage  mechanisms  include  metal-to-metal  seat 
frettinq  from  vibrational  exposure,  particulate  contamina- 
tion, imperfection  in  fabrication  and  loss  of  spring 
strength. 


Component  Reliability  Model  - Solenoid  Valve 
R = exp  (-  A CN  -Af  t) 


where  t * mission  time 

N « number  of  cycles 
*c=  cyclic  failure  rate 

time  dependent  failure  rate 

Failure  Rate  Uncertainty  Distribution  - Solenoid  Valve 


Log  Normal 

Coefficient  of  Variation 

t)  = 10.5 

8 

Mean 

M = -17.31 

-17.14 

Standard  Deviation 

a = 2.1707 

2.0431 
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aijHS^ateJtean_and  Bounds  - Solenoid  valve 


5 % Lower 


Bound 

Median 

Mean 

95%  Upper 
Bound 

\05 

\ 5 

E{\j 

*.95 

.001 

0.03 

.32 

1.08 

.001 

0.036 

.29 

1.04 

XI 0 ® per  hour  (cycle) 


by  Failure  Modes 


1,2  Failure  Rates:  „h  » , , J 

>W  ■ 10*)SAf|;  EtXCM|  - 10, Js  XcJ 

1*3  Failure  Rate  Mean  and  Bounds 


5%  Lower 
Bounds  Median  Mean 

\05  \5  e|a} 

0.00013  0.0036  0.029 

0.C0008  0.003  0.032 


95%  Upper 
Bounds 


0.104 


0.108 


XI 0 ® per  hour  (cycle) 
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2. 

Fail 

Closed 

2.1 

Model : 

R = exP[XcoN  " XfotJ 

2.2 

Failure 

Rates:  EJXf  f = 30%  E Uf  f ;%cp}  = 60% 

2.3 

Failure  Rate 

Mean  and  Bounds 

5%  Lower 
Bounds 

i 

Median  Mean 

95%  Upper 
Bounds 

x.05 

X.  5 E{x| 

x.  95 

Xfo 

0.0004 

0.0108  0.087 

0.312 

Xco 

0.00025 

0.009  0.096 

0.324 

XI 0 ® per 

hour  (cycle) 

3. 

Fail 

Partial 

3.1 

Model : 

R - exp 

;V-P  N -*fP  *J 

3.2 

Failure 

Rates:  E(Xfp|  s 55% 

Ejxf j;  Xcp  - 60» 

3.3 

Failure 

Rate  Mean  and  Bounds 

5%  Lower 

Rounds  Median  Mean 

95%  Upper 
Bounds 

X.  05 

x5  Eixi 

X.  95 

xfp 

0.0006 

0.020  0.16 

0.624 

xcp 

0.0005 

0.018  0.192 

0.648 

xlO-6 

per  hour  (cycle) 
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4. 


Leak  to  Space 


4.1 

4.2 

4.3 


Model : 

Failure  Rate: 


R - exp[-xfLtj 

El*fii=  5!  EUf! 


Failure  Rate  Mean  and  Bounds 


5%  Lower 

Bounds  Median ( Mean 

A-05  \5  E{x} 

*fL  0.00006  0.0018  0.0145 

x!0“6  per  hour 


95%  Upper 
Bounds 

*.95 

0.052 
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Component  Reliability  Model  - Explosive  Valve 

The  reliability  of  this  device  is  driven  by  the 
actuator  (explosive)  and  as  such  is  best  modelled  by  a log 
normal  success  probability  distribution.  Prior  to  activa- 
tion the  device  can  be  expected  to  have  a reliability  of 
1.0.  The  lognormal  model  is  applied  to  determine  the 
probability  of  success  at  the  expected  time  of  activation. 


Uncertainty  Distribution  Parameters  and  Reliability  Values 
Means  and  Bounds  - Explosive  Valve 


5%  Lower  Bound 

Mean 

95%  Upper 

R.  05 

E{R} 

R.  95 

a 

.3991 

. 3^9] 

.3991 

R(lyrj 

>.99997 

>>.99997 

>>.99997 

R ( 3yrs) 

.899" 

.9948 

.9983 

R(5yrs) 

.5 

.9 

.95 

R ( 7yrs) 

.1996 

.6689 

.7887 

R( lOyrs) 

.0412 

.324 

.4634 
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LATCH  VALVE 


The  function  of  this  valve  is  to  provide  selected 
interconnection  and  isolations  between  the  propellant 
tanks,  and  multiple  thrusters.  These  are  solenoid 
actuated  valves  and  they  experience  failure  modes  and 
mechanism  similar  to  the  solenoid  isolation  valves.  The 
reliability  model  developed  for  the  solenoid  isolation 
valves  should  apply  here  as  well. 


Component  Reliability  Model 


R = exp  [-  A CN  - A ft] 


where  t 
N 
X 
A 


C 

f 


mission  time 

number  of  cycles 

cyclic  failure  rate 

time  dependent  failure  rate 


Failure  Rate  Uncertainty  pistribution 
see  Solenoid  Isolation  Valves 


Failure  Rate  Mean  and  Bounds 


see  Solenoid  Isolation  Valves 
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RELIEF  VALVE 


The  function  of  this  component  is  to  protect  the  pro- 
pellant tanks  from  overpressurization.  Its  failure  modes 
and  mechanisms  are:  failure  to  open  due  to  armature  stick- 
ing, failure  to  close  due  to  spring  failure  or  armature 
sticking,  and  seal  leakage.  Spring  failures  can  result 
from  material  imperfections  and  fatigue;  armature  sticking 
can  result  from  contamination;  and  seal  leakage  can  result 
from  contamination  on  the  seat. 


Component 
R = 


Reliability  Model 

X 

X 
t 


exp 


-A  t -X  n1 
mm  c 

wher 


f 

c 

m 


N 


= failure  rate  per  mission 
hour 

= failure  rate  per  cycle 
- mission  time 
= number  of  cycles 


Failure  Rate  Uncertainty  Distribution  Model 


Log  normal 

Af 

*c 

Coefficient  of  Variation 

n - 

12.94 

1.12 

Mean 

H = 

-15.03 

-13. 178 

Standard  Deviation 

a = 

2.2642 

.9018 

I-i47 


Failure  Rate  Mean  and  Bounds 


5%  Lower  Bound 

Median 

Mean 

95%  Upper  Bound 

\ 05 

\ 5 

E{\} 

\95 

Xf  .0072 

0.297 

3.857 

12.32 

Ac  .43 

1.892 

2.841 

8.34 

X10 

-6 

per 

hour  (cycle) 
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BURST  DIAPHRAGM 


A burst  diaphragm,  3 ike  an  electrical  fuse,  has  a 
different  purpose  in  a nonrepairable  system  than  in  a con- 
ventional application.  In  conventional  applications,  such 
devices  may  be  intended  either  to  limit  damage  to  the 
equipment  in  which  they  are  installed  or  to  protect  a sy- 
stem in  which  the  equipment  is  nonessential.  In  nonrepair- 
able  systems,  only  the  latter  function  is  meaningful  be- 
cause it  may  involve  personnel  safety. 

Premature  bursting  of  a diaphragm  results  in  equipment 
failure;  failure  to  burst  when  intended  constitutes  system 
failure.  For  purposes  of  the  second  failure  mode,  the 
burst  diaphragm  is  redundant  with  (strictly  speaking,  is 
a backup  to)  the  relief  valve  and  should  be  regarded  as 
having  failed  only  if  pressure  containment  is  lost  and 
injury  or  system  damage  results. 

Tradeoff  between  the  two  failure  modes  is  inherent: 
reducing  the  probability  of  premature  bursting  virtually 
guarantees  an  increased  probability  of  failure  to  burst, 
and  conversely,  the  existence  of  redundancy  in  the  failure- 
to-burst  mode  influences  the  tradeoff. 

The  reliability  estimation  problem  is  compounded  fur- 
ther by  the  fact  that  burst  diaphragm  failure  must  be  de- 
fined in  somewhat  complicated  forms.  Premature  bursting 
occurs  if  pressure  exceeds  burst  strngth  and  is  less  than 
the  lower  v.  f actual  or  intended  relief  valve  setting. 
Failure  to  burst  occurs  when  burst  strength  of  the  dia- 
phragm exceeds  that  elsewhere  in  the  fluid  containment 
and  pressure  becomes  excessive,  the  latter  being  possible 
ii  the  relief  valve  malfunctions.  Such  compound  phenomena 
must  be  dealt  with  above  the  component  level.  At  the  sys- 
tem level,  components  such  as  the  burst  diaphragm  can  be 
treated  by  assuming  that  their  reliability  can  be  made 
high  enough  (when  used  with  another  component  such  as  a 
relief  valve)  to  yield  negligible  system  level  effect. 
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FILTER 


Propellant  leakage  due  to  loss  of  integrity  of  the  fil- 
ter housing  or  welds  can  be  characterized  by  a constant 
failure  rate,  mission-time  dependent,  exponential  model. 
Clogging  and  the  associated  failure  rate  tend  to  increase 
this  time;  this  suggests  a Weibul  model  using  operating  time 
as  the  variable.  The  shape  parameter  should  not  be  much 
greater  than  one  since  longevity  depends  on  variable  con- 
tamination levels  and  is  not  defined  sharply;  0 = 1.5  was 
selected. 


Component  Reliability  Model 


R = exp 


= leakage  failure  rate 
t = mission  time 
tQp  = operating  time 

0 = shape  factor  * 1.5 

a = scale  factor 
c 


The  values  for  the  failure  rate  (\L)  and  the  scale 
factor  (a  ) were  determined  in  the  following  manner. 
4vailablecdata  (eight  sources)  for  filter  failure  rates 
indicated  an, expected  total  failure  rate  value  of  E |X|  = 
0.0863  x IQ  /hr  ! 

The  data  base  further  indicated  an  approximately  equal 
apportionment  to  leakage  and  clogging  yielding 


X.t  « .043  Xl0“6/hr 

Li 

A = .043  Xl0”6/hr 
c 

In  order  to  transform  the  clogging  failure  rate  to  the  more 
appropriate  Weibull  model,  the  exponential  model  and  the 
Weibull  model  were  set  equal  (equal  expected  reliability) 
at  10,000  mission  hours. 
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and  a ratio  of  10:1  used  for  mission  time  to  operating 
time.  Using  previously  estimated  values 

0 = 1.5 

E|a}c}  = *043  X.10“6/hr 

a value  for  the  scale  factor  at  E|Ac|  was  obtained 
uc  = 7.35X107 

Failure  Rate  Uncertainty  Distribution  Model  (Leaking) 
Lognormal 


Coefficient 

of  Variation 

n 

Mean 

H = -18. 

345 

Standard  Deviation 

ff=  1.66 

Failure  Rate  Mtan 

and  Bounds 

(Leaking) 

5%  Lower  Bound 

Median 

Mean 

95% 

Upper  Bound 

x.05 

\5 

eI»l! 

.95 

.0007 

0.0107 

.043 

.166 

X10  6 per  hour 


Clogging  Failure  Weibull  Model  Mean  and  Bounds 


5%  Lower  Bound 
a 

c.  05 

1.9  X 107 


Median 


. 5 

2.94  X 10 


8 


Mean  95%  Upper  Bound 

Ct  a nc 

ce  c.95 

7.35  X 107  4.5  X 109 


Partition  by  Failure  Modes 
1.  Leakage 

1.1  Model  R = exp (-At; 

1.2  Failure  Rate  Mean  and  Bounds 


5%  Lower  Bound 

Median 

Mean 

95% 

Upper  Bound 

\ 05 

\ 5 

E|A) 

X.95 

.0.0007 

0.0107 

0.043 

0.166 

X10"6  per  hour 

Clogging 
] . 1 Model 

R = exp 

'-(t  )*’ 

,„°P_ 

a 

1.2  Weibull  Parameter  Values  and  Bounds 

5%  Lower  Bound 

Equivalent  Median  95%  Upper  Bound 

Mean 

“.05 

“e 

a.  5 

< 108 

a.  95 

1.9  X 107 

7.35  X 107 

2.94  1 

4.5  X 109 
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HEATER  (tank,  line  and  valve) 


To  prevent  the  'reezing  of  propellant  which  produces 
either  degraded  performance  or  catastrophic  failure  previously 
described,  electrical  heaters  are  used  to  maintain  a satis- 
factory thermal  environment.  Heater  locations  need  to  be 
determined  as  the  thruster  system  is  adapted  to  the  space- 
craft. There  may  be  as  many  as  three  heaters  applied  to  the 
tank,  line,  and  propellant  control  valve,  although  a smaller 
number  is  more  likely. 

A heater  failure  rate  contained  in  the  NRN* for  the 
satellite  environment  is: 

\=  0.450  + 350%,  -95%  per  106  part  hours. 

Lacking  any  information  to  the  contrary,  it  is  believed  that 
the  heaters  on  which  the  data  were  accumulated  had  an  environ- 
mental conditioning  function  similar  to  the  present  application. 
Therefore,  this  rate  is  estimated  as  appropriate.  The  question 
that  cannot  be  definitely  answered  is  the  extent  of  the  duty 
cycle  since  it  will  be  dependent  on  the  satellite  orbit  and 
the  need  for  environmental  protection  at  the  spacecraft  loca- 
tion. 


The  kinds  of  failures  expected  exclude  those  arising 
from  wide  temperature  excursions  and  other  stress-inducing 
phenomena.  More  likely  sources  of  failure  are  imperfections 
which  occur  randomly.  A constant  failure  is  appropriate. 


Component  Reliability  Model 

R = exp(-Xt)  where  t = mission  hours 

Failure  Rate  Uncertainty  Distribution  Model 


Log  Normal 

Coefficient  of  Variation 

V = 

2.016 

Mean 

M = 

-17.68 

Standard  Deviation 

a = 

1.27 

* 

NLDCO  Reliability  Notebook 
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Failure  Rate  Mean  and  RmmHc 


5%  Lower  Bound 
a.05 
0.0025 


Median 

a.5 

0,021 


Mean 


95%  Upper  Bound 


Elxl  A.  95 

°-°47  0.169 

* 10  6 per  hour 


HEATER,  EXTERNAL  THRUSTER  APPLICATION 


The  operational  environment  of  the  heater  in  this 
application  is  characterized  by  thermal  cycling  and  ther- 
mal gradient.  At  low  duty  cycles,  cooling  between  firings 
can  lead  to  thermal  excursions  of  nearly  1000  F,  Prolong- 
ed exposure  to  high  temperatures  results  from  its  posi- 
tion on  the  thrust  chamber  wall.  Under  these  conditions 
fractures  can  result  from  the  induced  thermal  stresses. 
Insulation  failure  can  lead  to  shorting  between  the  con- 
ducting heater  element  and  the  sheath.  Hot  spots  can  de- 
velop in  the  heater  element  at  capacity  locations  or  at 
necked  areas  produced  in  the  drawing  process.  Another 
potential  failure  occurs  at  the  joints  of  the  heater 
filament  and  adjacent  conductors.  Over  stress  can  occur 
in  brazing  or  welding  during  the  fabrication  process. 

Most  insulator  materials  used  are  hygroscopic.  Without 
proper  control  in  the  fabrication  process,  absorbed 
moisture  can  lead  to  insulator  breakdown  in  operation. 

This  component  is  further  characterized  by  a "burn 
in"  or  "in/out"  mortality  period.  This  effect  was  incor- 
porated in  the  model  by  using  an  initial  reliability  value 
less  than  1.0. 


Component  Reliability  Model 

R = P . exp  n - jojafH 

L c a J 

where  P = infant  mortality  factor 

\c  = heater  cycle  failure  rate 

t0p  = heater  operating  time 

P - Weibull  shape  factor  = 3 
a = Weibull  scale  factor 
N = number  of  heater  cycles 
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Cyclic  Failure  Rate  Uncertainty  Distribution 


Log  normal 

Coefficient  of  variation 

n = 

3.09 

Mean 

v-  = 

-17.1482 

Standard  Deviation 

Q- 

1.5354 

Cyclic  Failure  Rate  Mean  and  Bounds 


5% 

Lower  Bound 

Median 

Mean 

95% 

Upper  Bound 

Xc.05 

\ 5 

E Xc 

Xc.95 

i 

0.00286 

0.0357 

0.116 

0.446 

xio'"6 

per  cycle 

Operating  Time  (Weibull  Scale 

Factor) 

Mean  and  Bounds 

5% 

Lower  Bound 

Mean  Median 

95% 

Upper  Bound 

«.05 

aE 

« 5 

“95 

1.64X1032 

6. 3X1012 

2.046X1013 

14 

2.56X10 

Infant  Mortality,  P, 

Mean  and  Bounds 

5%  Lower  Bound 

Median/Mean  95%  Upper  Bound 

P.05 

EM  rM 

.977 

.99  ~.999 
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HEATER,  INTERNAL  THRUSTER  APPLICATION 


Notwithstanding  the  presence  of  the  protective  tube, 
the  cycle  of  the  heater  is  severe.  In  the  pulse  mode  of 
operation,  the  heater  is  in  a transient  state  as  it  de- 
livers heating  effects  over  a short  period  of  time  and  is 
further  heated  by  the  reaction.  At  duty  cycles  below  4 
percent,  cooling  between  pulses  can  bring  the  temperature 
down  so  that  the  excursion  can  be  nearly  1,000°F.  Under 
thermal  cycling  conditions,  stress  cycling  is  inevitable. 
In  addition  to  cycling,  there  are  thermal  gradients  under 
near  steady-state  operating  conditions.  For  the  case  of 
the  axial  heaters,  after  current  is  turned  off,  the  fila- 
ments will  be  conducting  heat  away  as  the  protective  tube 
rises  in  temperature  under  the  influence  of  the  decom- 
position reaction.  Additionally,  the  dissimilar  mater- 
ials on  the  metal  parts  and  insulator  of  the  heating  ele- 
ment, having  different  expansion  rates,  will  compound  the 
stresses  due  to  nonuniform  temperature  distribution. 

The  failure  modes  and  mechanisms  are  in  general  the 
same  for  the  internal  application  and  to  the  external 
application  thruster  heater.  The  resulting  model  is 
therefore  the  same.  The  heightened  severity  of  the  in- 
ternal heater  environment  is  reflected  in  the  model  para- 
metic  valves. 

The  limited  experience  base  (one  firm)  with  heaters 
in  this  application  is  reflected  in  the  magnitude  of  the 
uncertainty  distribution  parameters. 

The  complex  model  developed  initially  was  replaced 
with  one  following  the  general  form  of  the  external 
heater  reliability  model.  The  parameter  values  differ 
since  the  only  internal  heater  configuration  assessed  in 
the  study  differs  from  other  sheath  heaters.  This  dual 
inconel  filament  sheath  heater  was  designed  and  produced 
by  one  firm. 
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Component  Reliability  Model 


R 


P 


exp 


where  P = Infant  Mortality  factor 
= cyclic  failure  rate 
N = number  of  heater  cycles 


fcop  = heater  operating  time 

0 = Weibull  shape  factor  = 3.5 
a = Weibull  scale  factor 


Cyclic  Failure  Rate  Uncertainty  Distribution  Mode 1 
Log  Normal 

Coefficient  of  Variation  V = 7.32 

Mean  M =“17.182 

Standard  Deviation  a = 2.0 


Cyclic  Failure  Rate  Mean  and  Bounds 
5%  Lower  Bound  Median  Mean 

\)5  \5  e|\| 


0012 


0.0345 


.255 


95%  Upper  Bound 
X.95 
.926 

X10 “ ® per  cycle 


Infant  Mortality,  P,  Mean  and  Bounds 


5%  Lower  Bound 
P.  05 
.91 


Mean 

e jrj 

.96 


95%  Upper  Bound 
P.  95 
.99 


Operating  Time  (Weibull  Scale  Factor)  Mean  and  Bounds 
5%  Lower  Bound  Mean  Median  95%  Upper  Bound 


a 


'.05 


a. 


a 


7.07X10 


13 


“E  .5 

2.568X1014  1.9X1015 


*.95 

5.08X1016 


\ 
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ENGINE  VALVES 


Torque  motor  valves  have  few  or  no  sliding  parts 
that  would  be  subject  to  wear  binding  or'  seizing. 

However,  this  is  achieved  by  introducing  flexure  tubes 
that  may  be  subject  to  fatigue  and  fracture.  The  four 
data  points  available  on  torque  motor  valves  indicated 
no  apparent  difference  in  the  expected  failure  rate  of 
torque  motor  and  solenoid  engine  valves  (fourteen  data 
points  were  available  for  the  engine  valves) . 

Some  bipropellant  system  employ  an  engine  valve  with 
a single  actuation  (solenoid  or  torque  motor)  used  to  drive 
two  valve  poppets.  Examination  of  the  data  base  resulted 
in  no  identifiable  difference  in  failure  rate  for  this 
type  of  valve  when  compared  to  single  seat  valves.  Series 
redundant  dual  seat  valves  are  employed  in  some  monopro- 
pellant systems.  While  this  arrangement  reduces  the 
possibility  of  seat  leakage  due  to  contamination  it  intro- 
duces additional  parts  subject  to  wear,  erosion  and  corro- 
sion effects. 

The  overall  failure  rate  for  this  type  of  valve  falls 
in  the  central  range  of  the  total  valve  data  base.  This 
indicated  no  significant  advantage  (or  penalty)  at  the 
total  failure  rate  level. 

Finally  the  engine  valve  data,  including  electrothermal 
monopropellant,  catalytic  monopropellant  and  hypergolic 
bipropellant  system  component,  could  identify  no  credible 
base  for  alternate  reliability  models. 


Component  Reliability  Model 

The  single  engine  valve  model  consists  of  three  com- 
ponents, cyclic,  operating  time  and  mission  time.  Each 
of  these  components  is  characterized  with  growing  failure 
rates.  Valve  cycling  involves  wear,  fatigue,  and  a growing 
possibility  of  leakage  due  to  upstream  and  internally 
generated  contaminants.  Operating  time  and  flight  time 
allow  for  erosion  and  corrosion  of  valve  parts,  respectively. 
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by 


The  failure  rate  growth  phenomena  was  characterized 
Weibull  models.  This  yielded 


R = exp 


t P 
op 


where  p = 


N = 


Weibull  shape  factor  = 1.5 
number  of  cycles 
operating  time 
flight  time 
Cycle  scale  factor 
Operating  time  scale  factor 
Flight  time  scale  factor 


A shape  factor  of  ft  = 1.5  was  used.  The  scale  factors  ( a) 
were  determined  from  the  exponential  model  failure  rates 
in  the  same  manner  as  used  in  previous  components.  However, 
a specific  point  for  equivalency  of  the  two  models  was  not 
used.  Because  of  the  wide  range  of  mission  lengths,  thrust 
levels,  operating  lives,  etc,  encountered  by  this  type  of 
valve,  a more  flexible  approach  reflecting  design  life  was 
was  selected.  The  exponential  and  Weibull  models  were  then 
set  equal  at  half  the  design  life  of  the  valve  yielding 
the  following  scale  factors  ( a ) 


1-160 


( 5 N ) * 

Cyclic  scale  factor,  a = ’ D 


Operating  scale  factor,  a = (*5tQpD).5 


Fight  time  scale  factor,  o;f  = °) 


where  ND  = Total  design  life  cycles 

t = Total  operating  time 
opD  design  life 

= Total  flight  time  design 
tD  life 

X = Cycle  failure  rate 


= Operating  time  failure  rate 


= Flight  time  failure  rate 


Failure  Rate  Uncertainty  Model 


Log  normal 


Coefficient  of  Variation  ??  = 


1.52  2 


Mean 


-15.2 


•9.81  -14.6 


Standard  Deviation 


.704  1.0936  1.268 
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Exponential  Failure  Rate  Mean  and  Bounds 


(Used  to  determine  scale  factors  a , a , a ) 

c op  f 


5%  Lower 

Bound  Median 

Mean 

95%  Upper 
Bound 

*.05 

\ 5 

\95 

Cyclic  failure 

rate  \c  .079 

.25 

.322 

.8 

Operating  time  9.1 

failure  rate  \ 

op 

55 

100 

332 

Flight  time  .056 

failure  rate  A^ 

0.45 

1.0 

3.63 

X10 

_f*per  cycle  or  hour. 

Weibull  Model  Scale  Factor  Mean  and 

^unds 

5%  Lower  Bound 

Mean 

95%  Upper  Bound 

a 

.05 

a 

E 

a 

.95 

Cycle  Scale  Factor 

• 5N[) ) 

( . 5Nd) 

( . 5ND ) * 5 

a 

c 

Ac.95 

E!xcS 

Xc.05 

Operating  time 

5t  )*5  ( 

cpn 

*5tOpD) 

5 <-5tOPD>-5 

scale  factor  ~ 

a 

op 

*op.95 

EIV 

1 *op.05 

Flight  time 

<-5W 

S 5 

'■V 

scale  ractor 
a 

f 

Xf  .95 

E)xfj 

Kf  .05 
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Partition  by  Failure  Modes 


1.  Fail  Open 

1.1  Model:  R = exp 


~N 


■t  f-t/ 
op  f 


a a ar 
co  opo  fo 


, P=  1.5 


1.2  Failure  Rates  and  Weibull  Scale  Factors 

E|Xcol  ■ 10%  El*ci 

E!xoPo!  - 104  E)xopi 


;lxfcl  = 


10%  E 


!Af ! 


1.3  Weibull  Parameter  Values  and  Bounds 


5% 

Lower  Bound 

• 

Equiv.  Mean 

Median  95% 

Upper  Bound 

a 
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a 

.95 
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(-5tOpD»’5 
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OPD 
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332X10-5 

1X10"5 

5.5X10-6 

9.1X10"7 

“fo: 

(-5tfo»-5 

3.63X10-7 

ixio“7 

4.5X10"8 

5.6X10-9 

2.  Fail  Closed 

2.1  Model  R = exp 


-N1 


- l f-t* 

op  f 


a 


a 


a 


cc 


opc  fc 


li  = 1.5 
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2.2  Failure  Rates  and  Weibull  Scale  Factors 


eM  ° 

30%  E 

■W 

EjXopci  = 

30%  E 

;lAoP! 

Elxfc!  - 

30%  E 

2.3  Weibull  Parameter  Values 

and  Bounds 

5%  Lower  Bound 

Equiv.  Mean 

Median  95%  Upper  Bound 
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3.  Fail  Partial 

3.1  Model  R = 

= exp 
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op  f 
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3.2  Failure  Rates 
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3.3  Weibull  Parameter  Values  and  Bounds 

5%  Lower  Bound  Equiv.  Mean  Median  95%  Upper  Bound 


( . 5Nd)  * 5 

( . 5Nd)  ‘ 5 

( . 5Nd) 
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4.  Leak  to  Space 


4.1 

Model 

R = exp 
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4.2 

Failure 

Rates 
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4.3  Failure  Rate  Mean  and  Bounds 
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X.95 
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THRUSTER  CHAMBER  (MONOPROPELLANT) 


The  principal  failure  mechanisms  for  this  component 
include  nitriding,  cyclic  thermal  and  pressure  stressing 
and  fatigue.  These  mechanisms  are  time  dependent  and  in- 
dicative of  increasing  failure  rates.  Weibull  models  were 
again  used  in  a manner  similar  to  the  injector  and  catalyst 
bed.  Transition  from  exponential  failure  rate  data  to  the 
Weibull  models  was  accomplished  using  a 50%  design  life 
point  of  equivalency. 


Component  Reliabil ity  Mode 1 


R = exp 


-N 

£* 


Where  a 


c 

N = 


t = 
op 

a = 
op 


op  j 

pulse  failure  rate  scale  factor 
number  of  pulses 
operating  time 
operating  time  scale  factor 


Failure  Uncertainty  Distribution 


Log  normal 

A 

c 

V 

Coefficient  of  Variation 

V = 

1.8 

1.5 

Mean 

M = 

-18.45 

-16.10 

Standard  Deviation 

o = 

1.2019 

1.0875 
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Exponential  Model  Failure  Rate  Mean  and  Bounds 


5%  Lower 


95%  Upper 


Bound 

Median 

Mean 

Bound 

\()5 

X 

,5 

EM 

\n 

Pulse  failure 

rate,  Xc  .0013 

0.0097 

.02 

.07 

Operating  time 
failure  rate,  Xop. 017 

0.102 

.184 
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x!0“6 

per  hour  (cycle) 

Weibull  Model  Parameters 

Mean  and 

Bounds 
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Mean 
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V-  » .J 

E{Xc| 
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( . 5t  )* 

OpD ' 

5 

ODD 

6 5 

( . 5t  )* 

OpD 
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where  ND  = design  life  pulses 

to^D  ~ ^es ’ cJn  operating  time 

Shape  factor  fi  - 1.5  for  both  pulse  and  opera cing  time 

components  of  model 
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THRUST  CHAMBER  (BIPROPELLANT) 


This  component  has  potential  failure  modes  that  in 
general  will  tend  to  increase  with  accumulated  operating 
time.  They  are  (1)  rupture  of  the  chamber  due  to  flaws  in 
material  or  stresses  for  thermal  and  pressure  cycling; 

(2)  failure  of  weld  joints  due  to  imperfections  in  the 
weldments;  (3)  change  in  nozzle  contour  due  to  thermal 
stresses  and  erosion;  (4)  spalling  of  the  chamber  protec- 
tive coating. 


Component  Reliability  Model 

v_  yi 


R = exp 


a 


a 


where  N 


a 

a 


P 

op 


P 


= number  of  engine  pulses 
= operating  time 
= pulse  scale  factor 
= operating  time  scale  factor 
= shape  factor  = 1.5 


Exponential  Model  Failure  Rate 

Uncertainty 

Distribution 

Lognormal 

A 

c 

A 

op 

Coefficient  of  Variation 

T3  = 1.86 

1.86 

Mean 

-19.73 
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Standard  Deviation 

a = 1.223 

1.223 
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Exponential  Model  Failure  Rate  Mean  and  Bounds 

’5%  Lower  95%  Upper 


Bound 

Median 

Mean 

Bound 

\05 

'.5 

X 

.95 

Pulse  failure 
rate,  Xc 

.00013 

0.0027 

.0057 

0071 

Operating  time 
failure  rate,  XCp 
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Wei bull  Model  Scale  Factor  Mean  and  Bounds 
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Bound 
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Mean 

aE 
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.5 
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E!Xop(  Xop.  5 

(«5t  .)• 
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where  = design  life  pulses 

topd  = design  life  operating  time 
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INJECTOR  MONOPROPELLANT 


Failure  inodes  for  this  component  include  metal 
fatigue,  cracking,  and  nitriding  as  well  as  plugging  of 
the  injector  orifices.  These  failure  modes  indicate  in- 
creasing failure  rates  with  time.  As  in  previous  compo- 
nents Weibull  models  were  used  to  approximate  the  situa- 
tion. Leaking  at  the  injector  to  chamber  seals  is  also 
a significant  failure  mode.  While  the  probability  of  its 
occurrence  increases  with  time,  the  failure  rate  can  be 
expected  to  remain  constant. 


Component  Reliability  Model 

r-N*  t p 

R = exp 


QP  _ 


O' 


a 


X I^opj 


c 


op 


where:  a = cyclic  failure  rate  scale  factor 

c 

N = Number  of  cycles 

t = operating  time 

^ = operating  time  scale  factor 


= leakage  failure  rate 
/3  = shape  factor 


L-l  70 


Failure  Rate  Uncertainty  Distribution 


Log  normal 

Xc 

A 

op 

XL 

Coefficient  of 
Variation 
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1.2 

1.5 

Mean 

IX  = 
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Deviation 
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Exponential  Model  Failure  Rate  Mean  and  Bounds 
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Mean 
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\ 
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.0028 
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2 228 
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where  A 

c 

= cyclic  failure 

rate 

Xop 

= operating  time 

failure 

XL 

- leakage  failure 

rate 
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Weibull  Reliability  Model 

Shape  Factor 

Mean  & Bounds 

5%  Lower 
Bound 

Median 

Mean 

95%  Upper 
Bound 

a.05 

“e 
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a.  95 

a 
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where 

a 

c 

a 


A 

X 


op 

c.95 

c . 05 


t 

ope 
\>p  c 0 5 

Xop . 0 5 


shape-  factor  for  cycles 

shape  factor  for  operating  time 

95%  Upper  Bound  for  exponential  model 
cyclic  failure  rate 

5%  Lower  Bound  for  exponential  model 
cyclic  failure  rate 

design  life  cycles 

design  operating  time  (hours) 

analagous  to  X ^ ^ 
analagous  to  X 

c.05 
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Partition  by  Failure  Modes 
1.  Clogging 

1.1  Model  : R = exp 


0 


1.5 


1.2  Failure  Rate 


E Poll  = 50%  E Pop! 

1.3  Weibull  Parameter  Values  and  Bounds 

5%  Lower  95%  Upper 

Bound  Equiv.  Mean  Median  Bound 
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2. 


Leaking,  Excessive 
2.1  Mpdel  : R = 


flow  n 


exp 


-N' 


2.2  Failure  Rates 


t P 
QP 
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2.3  Failure  Rate  Mean  and  Bounds 
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2.4  Weibull  Parameter  Mean  and  Bounds 
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INJECTOR  BIPROPELLANT 


Failure  modes  of  this  component  include  plugging  and 
fatigue  induced  by  pressure  and  temperature  cycling.  These 
modes  indicate  an  increasing  failure  rate  model  should  be 
used.  The  scale  parameter  for  the  Weibull  (increasing 
failure  rate)  model  was  made  dependent  on  design  life  to 
increase  model  responsiveness  to  the  broad  range  of  bipro- 
pellant thruster  systems  performance  levels.  The  point  of 
equivalency  used  for  transition  from  exponential  model  data 
to  Weibull  scale  factor  was  50%  of  design  life.  Internal 
and  external  thruster  leakage  are  also  principal  failure 
modes.  These,  however,  were  expected  to  be  random  failure 
situations  and  therefore  were  represented  using  a constant 
failure  rate. 


Component  Reliability  Model 
R=exp  f-  x Ltop 

where  A = 

Li 

t = 

op 

N= 


0= 


a~ 


internal  leakage  failure  rate 
operating  time 
number  of  engine  pulses 
Weibull  shape  factor  = 1.5 
Weibull  scale  factor 


Failure  Rate  Uncertainty  Distribution-Internal  Leakage 
Log  normal 

Coefficient  of  variation  h ~ 1.86 

Mean  n = -12.77 

Standard  Deviation  cr=  1.2254 
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Failure  Rate  Mean  and  Bounds-Internal  Leakage 


5%  Lower  Bound 

Median  Mean 

95% 

Upper  Bound 
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Failure  Rate  Uncertainty  Distribution  - Pulse 
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Weibuli  Scale  Factor  Mean  and  Bounds 
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CATALYST  BED  (INCLUDING  RETENTION  SCREENS ) 


The  principal  identified  failure  mechanisms  for  catalyst 
bed  assembly  (catalyst  poisoning,  particle  structural  break- 
down, fines  migration  and  bed  packing,  catalyst  erosion, 
catalyst  bed  voids  and  nitriding  of  screen  retainers)  indicate 
growing  failure  rates  with  thruster  use.  Weibull  models  were 
used  to  reflect  these  situations.  The  catalyst  bed  assembly 
is  also  sensitive  to  the  mode  of  operation  of  the  thruster 
(cold  start,  hot  pulsing  and  steady  state) . Some  catalytic 
hydrazine  thruster  are  designed  to  operate  in  the  cold  start 
mode.  Others  employ  heaters  to  avoid  cold  starting.  While 
one  general  model  was  used  for  all  cases,  three  sets  of 
failure  rates  and  Weibull  scale  and  shape  factors  were  employ- 
ed to  yield  models  for  the  cold  start,  hot  pulsing  and  steady 
state  situations.  In  calculating  the  Weibull  scale  factors 
from  constant  failure  rate  data,  the  same  approach  was  used 
as  was  employed  in  the  injector  reliability  models.  The 
equivalent  point  between  exponential  and  Weibull  models  was 
selected  at  50%  of  design  life.  This  approach  will  allow 
1)  a more  definitive  assessment  of  cold  start  and  hot  start 
thruster  in  the  context  of  the  design  and  mission  require- 
ments 2)  an  alternate  mode  of  assessment  for  hot  start 
thruster  if  the  thruster  heaters  have  failed. 


Component  Reliability  Mode 1 s 


R ~ exp 
pulse 


-N^  n^  t ft  \,t, 
op  d d 
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cs 


cv 


op 


R = exp 
steady 
state 


N 

ss 


ft 


t ft  At 
ss  d d 


lns 


a 


cs 
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ss 


where  N = number  of  pulses  excluding  cold  starts 

N = number  steady  state  cycles 
s s 

n = number  of  cold  starts 
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t = operating  time,  pulse  mode 

t = operating  time,  steady  state 
s s 

t.  = dormant  time 
a 

ac  = pulse  scale  factors 

aNs  = steady  state  pulse  scale  factor 

a =»  cold  start  scale  factor 
cs 

a = steady  state  operating  time  scale  factor 
s s 

= operating  time  scale  factor 

X.  = dormant  failure  rate 
d 

(3  = shape  factor 


Exponential  Model  Failure  Rates  Mean  and  Bounds 
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op 

cold  start 
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cs 
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rate, X 

ss 
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Weibull  Reliability  Model  (Pulse  Mode)  Scale  Factor  Mean 
and  Bounds 


5%  Lower  Bound  Mean  95%  Upper  Bound 


Pulse  scale  factor  a / . ISN  _ 
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Xc . 05 


Operating  time  a 
scale  factor  c 


Cold  start  a 
scale  factor  cs 
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L lXop[ 

Aop.  05 
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(.5nn)2 

Xc  s . 9 5 
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where  Nd  = design  life  pulses 

topD  = design  operating  time 
nD  = design  cold  starts 


Weibull  Shape  Factor  (/l)_Values 


Model  Component 


Pulse  — 

“c 

nP 

Cold  Start  — 
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Cyclic  Operating 

time  — 
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Steady  State 
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Wei bull  Reliability  Model  (Steady  $tate Mode)  Mean  and  Bounds 


5%  Lower  Bound  Mean 


Steady  state 
pulse  scale 
factor  cvns 
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. 5N 


SSD 
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5t 
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. 5t 
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where  N , = design  steady  state  state  pulses 

tssd  = design  steady  state  operating  time 


Failure  Rate  Uncertainty  Distributions 


Lognormal 

Coefficient  of  Variation  V 
Mean  p 
Standard  Deviation  o 

Lognormal 

Coefficient  of  Variation  w 
Mean  V 
Standard  Deviation  cr 


xc 

Aop 

' cs 
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1.5 

-16.84 

-13.392 

-11.99 

1.2019 
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1.0875 

*ss 

Xd 

Ans 

1.5 
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1.5 
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-12.79 

1.0875 

1.2019 

1.0875 
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THRUSTER  SCREEN  AND  RETAINER  PACKS  (ELECTROTHERMAL) 


The  principal  mode  of  failure  of  this  component  was 
assessed  to  be  loss  of  structural  integrity  of  the  platinum 
screen  pack  retainer.  The  identified  failure  mechanism 
was  nitriding  of  the  reta’.ier  (currently  Haynes  25).  Due 
to  the  lack  of  directly  < pplicable  data  for  the  retainer 
the  reliability  model  was  limited  to  a Weibull  component 
used  to  characterize  the  increasing  failure  rate  due  to 
nitriding.  The  scale  factor  depending  on  design  life  was 
employed  to  reflect  the  broad  scope  of  potential  thruster 
operating  times  and  cycles. 


Component  Reliablity  Model 


R = exp 


where 


operating  time 
shape  factor  = 2.5 
scale  factor 


Exponential  Model* Fail > iro  Rate  Mean  and  Bounds * 

* (Estimated  using  limited  catalyst  bed  retainer  data 
as  a guide) 
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Exponential  Model  Failure  Rate  Uncertainty  Distribution 


Lognormal 

Coefficient  of  Variation 
Mean 

Standard  Deviation 


t)  = 1.504 

H = -16.016 

a = 1.0875 


Scale  Factor  Mean  and  Bounds 


Based  on  limited  data  available  for  catalyst  bed  re- 
tainers, the  following  scale  factors  were  determined.  The 
transition  from  exponential  model  data  to  Weibull  model 
scale  factor  wss  made  using  a point  of  equivalency  of  10% 
the  design  life. 
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SYSTEM  LEVEL  FAULT  TREES 


The  seven  systems  generically  represented  in  figures 
2 through  8 of  this  report  were  analyzed  using  the  fault 
tree  approach  discussed  earlier.  Regardless  of  approach  a 
greater  degree  of  specifity  concerning  system  configuration 
was  required  to  conduct  a system  analysis.  AFRPL  provided 
the  required  information  including  number  and  deployment 
of  thrusters,  valves  and  redundant  components.  The  re- 
sulting fault  trees  are  presented  in  this  section  in  the 
following  format.  For  each  system: 

. A brief  description  of  the  system  is  provided 

. A schematic  of  the  system  showing  redundancies 

and  numbers  of  components  is  included 

, The  fault  tree  analysis  is  presented. 

The  symbology  used  in  the  fault  tree  logic  diagrams  is 
defined  in  Table  8. 

Cesium  Ion  Electron-Bombardment  Thruster.  The  following 
requirements  of  the  mercury  electron-bombardment  engine  apply 
to  the  cesium  engine: 

. The  thrust  level  for  stationkeeping  is  approxi- 
mately 1 millipound 

. The  orbit  adjustment  operations  extend  over  10,000 
hours,  including  2 !5 5 5 firing  cycles. 

The  1-millipound  cesium  ion  thruster  system  has  been 
developed  for  this  kind  of  mission.  Its  specific  application 
is  on  board  the  ATS-F  (later  designated  ATS-6)  satellite 
for  north-south  stationkeeping  on  the  synchronous  orbit, 
but  it  is  also  compatible  with  the  USAF  stationkeeping  mis- 
sion. Functionally  comparable  to  the  mercury  thruster,  the 
1-millipound  cesium  ion  thruster  system  will  be  the  focus 
of  this  analysis. 

A schematic  of  the  system  analyzed  is  shown  m Figure 
11.  The  fault  tree  analysis  is  presented  in  Figure  12. 

(For  component  level  detail  of  the  "THRUSTER"  element  of 
Figure  11  refer  to  Figure  2 Cesium  Ion  Electron  Bombard- 
ment Generic  Systems  Layout  , page  1-4) , 
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Figure  li  Cesium  Ion  System  Schematic 
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CESIUM  ION  ELECTRON  BOMBARDMENT  SYSTEM 
FAULT  TREE  ANALYSIS 
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Figure  12  (Continued) 
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Figure  12  (Continued) 
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Figure  12  (Continued) 
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Figure  12  (Continued) 
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Figure  12  (Continued) 
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Figure  12  (Continued) 


Mercury  Ion  Electron-Bombardment  Thruster . Because  of  the 
very  limited  developmental  activity  in  ion  thrusters,  the 
analysis  presented  here  was  based  heavily  on  one  specific 
design,  the  8-centimeter  (cm)  Structurally  Integrated  Thrus- 
ter (SIT-8) , which  produces  the  thrust  level  required  for  the 
missions  of  interest.  Generally,  this  unit  is  regarded 
as  a second  generation  of  evolution  in  mercury  (Hg)-ion 
electron-bombardment  technology.  The  experience  accrued 
through  the  SIT-5  development,  which  included  extensive 
laboratory  testing  to  establish  durability  and  predict 
useful  life,  provides  the  foundation  for  the  new  design. 
Additionally,  experience  gained  in  development  of  15- 
and  30-cm  primary  propulsion  units  is  available,  in- 
cluding the  successful  flight  results  of  thousands  of 
hours  of  operation  aboard  SERT  II. 


Despite  this  existing  development  background,  the 
technology  of  Hg-vapor  electron-bombardment  thrusters  is 
very  low  in  maturity  from  the  reliability  viewpoint.  The 
vital  components  are  unique  designs  without  series  produc- 
tion and  without  statistically  valid  failure  rates. 

In  an  ion  engine,  the  propellant  is  transformed  to  an 
emitted  stream  of  ions  which  have  been  electrostatically 
accelerated  to  produce  thrust  forces.  The  SIT-8  propellant 
storage  and  distribution  subsystem  contains  liquid  Hg  under 
pressure.  Since  the  porous  plugs  in  the  feed  lines  cannot 
be  wetted  by  liquid  Hg,  the  propellant  is  positively  con- 
tained until  the  vaporizer  is  activated.  With  the  vaporizer 
heater  on,  flow  is  initiated  and  maintained.  The  single 
Hg  reservoir  serves  both  the  main  cathode  and  the  neutralizer 
through  branched  feed  lines,  each  with  its  own  plug-vaporizer. 
Phys'cally,  the  cathode-isolator-vaporizer  (CIV)  components 
are  closely  integrated  and  often  referred  to  as  the  CIV 
assembly. 

A schematic  of  the  system  analyzed  is  shown  in 
Figure  13.  The  fault  tree  analysis  is  presented  in 
Figure  14.  (For  component  level  detail  of  the  "THRUSTER" 
element  of  Figure  13,  refer  to  Figure  3,  Mercury  Ion 
Electron  Bombardment  Generic  System  Layout,  page  1-5). 
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Figure  13.  Mercury  Ion  System  Schematic 
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MERCURY  ION  ELECTRON  BOMBARDMENT  SYSTEM 
FAULT  TREE  ANALYSIS 
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Figure  14  Mercury  Ion  System  Fault  Tree  Analysis 
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Figure  14  (Continued) 
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Figure  14  (Continued) 
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Solid  Propellant  Pulsed  Plasma  System.  Current  solid  pro- 
pellant  pulsed  plasma  systems  employ polytetraf louroethylene 
(Teflon)  as  the  propellant.  The  exposed  face(s)  of  the 
Teflon  are  subjected  to  electrical  discharges  that  ablate 
and  depolymerize  surface  layers  and  convert  the  products 
into  a plasma  that  is  ejected  through  a nozzle.  Each  pulse 
involves  initiating  a discharge  by  an  igniter  that  generates 
a "microplasma"  which,  in  turn,  initiates  the  discharge  across 
the  Teflon.  Energy  for  the  discharge  is  obtained  from  one 
or  more  high-voltage,  high-capacitance  energy  storage  capa- 
citors. The  capacitors,  in  turn,  are  fed  from  conventional 
spacecraft  d.c.  busses  through  stepup  and  charge  control 
circuitry;  Capacitor  charging  occurs  between  pulses  but 
does  not  necessarily  occupy  the  entire  interval  between 
discharges. 

No  fuel  feed  control  is  required.  The  thruster  struc- 
ture accommodates  the  Teflon  in  the  form  of  solid  rods  which 
may  be  straight  or  curved  and  have  rectangular  cross  sections. 
As  ablation  takes  place,  constant-force  (Negator)  springs 
advance  the  remaining  Teflon  to  a shoulder  of  the  discharge 
electrodes.  The  Teflon  is,  of  course,  self-lubricating  in 
its  fead  guides.  Since  there  are  no  significant  cyclic 
loads  on  the  feed  system,  the  failure  rate  is  expected  to 
be  negligible. 

The  mechanical  simplicity  of  the  solid  propellant  pulsed 
plasma  thruster  causes  reliability  to  be  dominated  by  the 
electronic  aspects.  Reliability  analysis  for  charging, 
discharge-initiating,  and  associated  circuitry  is  to  be 
performed  by  the  methods  outlined  in  the  Electronic  Compo- 
nents and  Assemblies  section,  where  detailed  discussion  of 
two  special  electronic  components,  the  energy  storage  capa- 
citor and  the  ignitor,  also  appears. 

A schematic  of  the  system  analyzed  is  shown  in  Figure 
15.  The  fault  tree  analysis  is  presented  in  figure  16. 

(For  component  level  detail  of  the  "THRUSTER"  element  of 
Figure  15,  refer  to  Figure  4,  Pulsed  Plasma  Generic  Sys- 
tem Layout,  page  1-6). 
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Figure  16  (Continued 


Colloid  Electric  Propulsion  System.  The  thruster  is  com- 
prised of  12  modules,’  each  of  which  consists  of  36  hollow 
tubes  (needles) . The  propellant  (sodium  iodide-doped  gly- 
cerol) is  ted  through  the  needles  to  their  tips,  where  it 
is  exposed  to  a vacuum  and  a high  voltage  gradient  (**14kv) 
between  the  needles  and  the  extractor  plate.  The  voltage 
gradient  breaks  the  propellant  into  droplets  that  have  a 
positive  electron  charge,  and  accelerates  them  to  provide 
the  thrust.  Test  verify  that  specification  level  perfor- 
mance can  be  achieved  and  that  nonwetting  films  of  oil- 
like contamination  must  be  prevented  from- accumulating  on 
the  needle  tips. 

The  feed  system  consists  of  a storage  bellows  and  a 
flow  controller.  In  addition  to  containing  the  propellant 
until  demanded  by  the  thruster,  the  bellows  has  a spring 
force  that  pressurizes  the  propellant  so  that  it  can 
flow  against  the  various  impedances  of  the  system.  The 
controller  acts  as  a propellant  shutoff  device  and  regulates 
flow  through  a ball  seat  to  meet  thrusted  demands.  Flow 
regulation  and  termination  were  found  to  be  sensitive  to 
voids  within  the  propellant  to  the  controller. 

The  neutralizer  is  a thin  (0.002  in.  diameter)  tungsten 
wire,  which  is  heated  until  a sufficient  quantity  of  elec- 
trons is  emitted  to  equal  the  positive  current  from  the 
thruster.  Accelerated  life  tests  demonstrated  that  analy- 
tical derived  lifetime  projections  were  conservative  and  that 
lifetime  is  not  substantially  influenced  by  exposure  to 
vapor  (propellant). 

The  power  conditioner  converts  input  power  from  the 
spacecraft  into  the  forms  (voltage  and  frequency)  required 
by  the  various  elements  of  the  thruster  system.  In  addition, 
it  controls  system  operating  functions,  accepts  and  imple- 
ments ground  commands,  and  provides  a telemetry  output  of 
critical  operating  parameters.  Its  basic  function  is  to 
provide  high-voltage  power  to  the  thruster  by  means  of  an 
inductive  storage  circuic. 

(For  component  level  detail  of  the  "THRUSTER"  element 
of  Figure  17  refer  to  Figure  5,  Colloid  Generic  System 
Layout,  page  1-7)  . 
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Catalytic  Monopropellant.  This  is  one  of  the  most  widely 
used  auxiliary  propulsion  systems.  It  has  been  applied  over 
a broad  spectrum  of  thrust  levels  and  mission  times.  The 
basic  scheme  derives  thrust  from  the  spontaneous  exothermic 
decomposition  of  hydrazine  when  it  is  brought  into  contact 
with  a catalyst:  Initially  a catalyst  was  used  (H— 7 ) that 

required  heating.  The  catalyst  currently  employed  is 
Shell  405  granule  forms  of  various  sizes.  DeveJ  jpmental 
work  is  underway  on  monolithic  catalyst  system,  but  the 
Shell  405  catalysts  are  in  use  exclusively  at  this  time 
and  comprise  the  catalyst  bed  analyzed  in  this  study.  Mild 
heating  of  the  catalyst  bed  is  employed  in  some  designs 
to  prolong  catalyst  life  and  minimize  rough  start  conditions. 
"Cold  start"  designs  have  also  been  produced  and  employed 
with  success.  A blowdown  pressurization  system  was  used 
in  conjunction  with  the  catalytic  thruster  in  this  analysis. 
However,  pressurized  surface  tension  schemes  and  constant 
regulated  pressure  schemes  may  also  be  employed.  Each  of 
these  alternatives  ahs  been  assessed:  pressurized  surface 

tension  in  conjunction  with  the  electrothermal  thruster 
and  constant  pressure  with  the  bipropellant  thruster.  The 
three  thruster  types  and  the  three  pressurization  systems 
are  completely  interchangeable. 

The  interchanging  of  appropriate  fault  tree  branches 
will  yield  "synthesized"  fault  trees  for  all  desired 
combinations. 

A schematic  of  the  system  analyzed  is  shown  in  Figure 
19.  The  fault  tree  analysis  is  presented  in  Figure  20. 


(For  additional  system  details  refer  to  Figure  6,  Catalytic 
Monopropellant  Generic  System  Layout  page  1-8). 


1-223 


CATALYTIC  MONOPROPELLANT  SYSTEM 


FAULT  TREE  ANALYSIS 


ROt-c  OR  PITt  H 
Pu«\j<  Tr  o/v 


wz 


1-227 


Figure  20  (Continued) 
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Figure  20  (Continued) 
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Figure  20  (Continued) 
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Figure  20  (Continued) 
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Electrothermal  Thruster . Like  the  catalytic  monopropellant 
thruster  described  above,  the  electrothermal  thruster  de- 
rives thrust  from  the  exothermic  decomposition  of  hydrazine. 
It  differs,  however,  in  the  method  of  initiation  of  the  de- 
composition reaction.  Instead  of  using  a catalyst  bed,  the 
reaction  is  thermally  induced  with  sheath  heaters  serving 
as  the  heat  sources.  Two  design  approaches  to  heating  the 
thrust  chamber  were  analyzed.  The  first  employs  heaters 
externally  mounted  on  the  thrust  chamber.  These  heating 
elements  provide  thermal  energy  to  platinum  screen  packs 
housed  within  the  thrust  chamber.  Decomposition  of  the 
hydrazine  is  initiated  as  the  monopropellant  comes  in  con- 
tact with  the  heated  screen  pack.  The  second  approach  em- 
ploys a heating  rod  mounted  on  the  main  axis  within  the 
thrust  chamber  as  the  principal  heat  source.  The  swirled 
injection  of  hydrazine  results  in  a cylindrically  shaped, 
thermally  induced  decomposition  zcne  about  the  internal  rod 
heater.  This  approach  also  employs  external  heating  elements 
to  supplement  the  internal  heater. 

Either  electrothermal  approach  requires  power  levels  of 
only  3 to  5 watts  to  initiate  operation  for  medium  milli- 
pound  units.  If  the  duty  cycle  is  greater  than  approximately 
5 percent,  and  cooldown  between  pulses  does  not  occur,  the 
electric  heaters  can  be  turned  off.  The  decomposition 
reaction  is  sustained  by  the  self  generated  heat. 

A pressurized  surface  tension  propellant  containment/ 
delivery  system  was  used  in  conjunction  with  the  electro- 
thermal thruster  in  this  analysis.  However,  the  blowdown 
pressurization  and  the  regulated  constant  pressure  schemes 
(analyzed  in  conjunction  with  the  catalytic  monopropellant 
thruster  and  hypergolic  bipropellant  thruster,  respectively) 
may  also  be  employed.  The  interchangeability  of  the  appro- 
priate fault  tree  branches  will  yield  "synthesized"  fault 
trees  for  all  desired  combinations. 

A schematic  of  the  system  is  shown  in  Figure  21.  The 
fault  tree  analysis  is  presented  in  figure  22.  For  addi- 
tional details  of  the  alternate  thruster  configurations  and 
other  system  components  refer  to  Figure  7,  Electrothermal 
Monopropellant  Generic  System  Layout,  page  1-9. 
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Figure  22 „ Electrothermal  Monopropellants  System  Fault  Tree  Analysis 
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Figure  22  (Continued) 
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Figure  22  (Continued) 
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Figure  22  (Continued) 
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Figure  22  (Continued) 
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Figure  22  (Continued) 
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Bipropellant  Thruster.  The  bipropellant  thruster  analyzed 
in  this  study  is  of  the  hypergolic  type.  It  derives  thrust 
from  the  spontaneous  exothermic  reaction  which  results  when 
monomethyl  hydrazine  and  nitroqen  tetroxide  are  brought 
into  contact  with  each  other. 

As  discussed  in  the  previous  thermochemical  propulsion 
systems,  three  pressurization  schemes  may  be  used  inter- 
changeably with  the  three  propulsion  systems.  For  the 
purposes  of  this  study,  each  propulsion  system  used  a dif- 
ferent pressurization  approach.  The  constant  regulated 
pressure  approach  was  used  in  conjunction  with  the  bipro- 
pellant thruster.  The  interchanging  of  appropriate  fault 
tree  branches  will  yield  fault  trees  for  all  desired  com- 
binations . 

A schematic  of  the  system  is  shown  in  Figure  23.  The 
fault  tree  analysis  is  presented  in  Figure  24.  ;For  addi- 
tional detail  on  system  components  refer  to  Figure  8,  Bi- 
propellant Generic  System  Layout,  page  1-8. 
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Figure  23.  Hypergolic  Bipropellant  System  Schematic 
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Figure  24  (Continued) 


Figure  24  (Continued) 
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Figure  24  (Continued) 
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Figure  24  (Continued) 
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Figure  24  (Continued) 


1-273 


Figure  24  (Continued) 
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Figure  24  (Continued) 
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Figure  24  (Continued) 
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Figure  24  (Continued) 
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Figure  24  (Continued) 
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Figure  24  (Continued) 
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